upper midwest hie consortium - north dakota€¦ · the upper midwest health information exchange...

ONC State Health Policy Consortium Project

The Upper Midwest State

Health Policy Consortium on

Health Information

Exchange

Final Report on Interstate Consent

Management

October 2011

The Upper Midwest State Health Policy Consortium on Health Information Exchange:

Final Report on Interstate Consent Management

Upper Midwest Consortium October 2011


Document Status: Final Report

ii

The Upper Midwest State

Health Policy Consortium on

Health Information Exchange:

Final Report on Interstate

Consent Management

Table of Contents

1. Executive Summary ....................................................................................... 1

2. Process to Identify Tools and Mechanisms to Advance Interstate HIE .......... 4

2.1 Environmental Scan .................................................................................. 4

2.2 Review of Potential Mechanisms for Interstate Agreement .............................. 5

2.3 Discussion and Agreement on Policy Alignment as Preferred Mechanism .......... 7

2.4 Development of the UM HIE Workgroups and Tools to Enable Interstate

HIE ......................................................................................................... 7

3. Recommendations and Tools ......................................................................... 9

3.1 Common Consent Form Workgroup and Charge ............................................ 9

3.1.1 Disclosures to be Enabled by the UM HIE Tools ................................... 9

3.1.2 The UM HIE Tools to Enable the Interstate Exchange ......................... 10

3.1.3 UM HIE Tool Implementation: Common Scenarios ............................ 14

3.2 Electronic Transmission Workgroup and Charge .......................................... 15

3.2.1 Initial Recommendations ............................................................... 15

3.2.2 Implementing Recommendations .................................................... 16

3.3 Policy Alignment Workgroup and Charge .................................................... 17

3.3.1 Legislative or Regulatory Policy Levers ............................................ 18

3.3.2 Market Levers .............................................................................. 20

3.3.3 Informal Policy Levers ................................................................... 23

4. State Action Plans for Stakeholder Engagement and to Promote

Adoption ..................................................................................................... 25

4.1 Illinois Process to Engage Stakeholders ..................................................... 25

4.2 Minnesota Process to Engage Stakeholders ................................................ 26

4.3 North Dakota Process to Engage Stakeholders ............................................ 26






iii

4.4 South Dakota Process to Engage Stakeholders ........................................... 27

4.5 Wisconsin Process to Engage Stakeholders ................................................. 27

5. Recommendations for Future Work and Considerations .............................. 28

5.1 Proposed Process to Ensure UM HIE Tools Remain Current ........................... 28

5.2 Proposed Pilot Project to Test the Use and Effectiveness of the UM HIE

Tools ..................................................................................................... 29

5.3 Areas Where Additional State Health Policy Consortium Work Would be

Helpful to UM HIE States .......................................................................... 29

5.4 Guidance for Future Implementation ......................................................... 31

Appendices

Appendix A: Tools to Support State Consortia Addressing Barriers to HIE

Exchange

A-1. Table on Interstate Agreement Mechanisms

A-2. Environmental Scan Template

A-3. UM HIE Environmental Scan Summary

A-4. Interstate Use Cases

A-5. HIE Process Flows and Considerations

A-6. Table on Electronic Consent Options

A-7. Inventory on Policy Alignment Options

Appendix B: UM HIE Tools for Enabling Interstate HIE

B-1. Upper Midwest Consent Matrix

B-2. Upper Midwest Common Consent Form

B-3. Upper Midwest Health Information Request Form

Appendix C: State Action Plans

C-1. Minnesota State Action Plan

C-2. North Dakota State Action Plan

C-3. South Dakota State Action Plan

C-4. Wisconsin State Action Plan

Appendix D: Pilot Proposal to Demonstrate UM HIE Consortium Work






iv

Contributing Authors

Minnesota

James I. Golden, PhD

Deputy Assistant Commissioner for Healthcare

State Government HIT Coordinator

MN Department of Human Services

Liz Cinqueonce

Deputy Director

Office of Health Information Technology

Minnesota Department of Health

Donna Watz, JD

Director of Privacy, Security and HIE Oversight Programs



Bob Johnson, MPP

e-Health Project Manager



M. Kate Chaffee, JD

State Subject Matter Expert

Wisconsin

Beth DeLair, JD, RN


Kathy Johnson

Wisconsin Department of Health Services Privacy Officer

Denise Webb

Wisconsin State Health IT Coordinator

Matthew Stanford

Wisconsin Statewide Health Information Network (WISHIN)

South Dakota

Kevin DeWald

State Health IT Coordinator

South Dakota Department of Health

Richard Puetz, JD, CPA

Professor of Accounting and Business Law

College of Business & Information Systems

Dakota State University







v

North Dakota

Pam Crawford

Assistant Attorney General

Office of the North Dakota Attorney General

Michael J. Mullen, JD

Special Assistant Attorney General

Office of the North Dakota Attorney General


Sheldon H. Wolf

North Dakota Health Information Technology Director

Illinois

Mark Chudzinski, JD, MBA

General Counsel

State of Illinois


Marilyn Lamar, Esq.

Liss & Lamar, P.C.


RTI International

Stephanie Rizk, MS

Health IT Research Analyst

RTI International

Julie Singer, PhD

Research Survey Specialist/Research Psychologist

RTI International

Baker Donelson

Susan Christensen, JD

Senior Public Policy Advisor Baker, Donelson, Bearman, Caldwell & Berkowitz, PC

Alisa Chestler, JD

Counsel

Baker, Donelson, Bearman, Caldwell & Berkowitz, PC

Additional Subject Matter Expert

Noam H. Arzt, PhD

HLN Consulting, LLC




1

1. Executive Summary

The Office of the National Coordinator for Health IT (ONC) created the State Health

Policy Consortium (SHPC) project to support multistate initiatives that would develop

solutions to policy challenges specific to interstate health information exchange. The

SHPC is funded by the Health Information Technology for Economic and Clinical Health

(HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009.

The SHPC is a natural evolution from prior multistate work such as the Health

Information Security and Privacy Collaboration (HISPC) and State eHealth Alliance

projects also sponsored by ONC.

The Upper Midwest Health Information Exchange State Health Policy Consortium (UM

HIE) project was the first multistate consortium to receive support from RTI

International, the research institute that manages the overall SHPC project for ONC. The

participating States included Minnesota (serving as lead State), Illinois, North Dakota,

South Dakota, and Wisconsin.1

The goal of the UM HIE Consortium was to create a regional vision and develop concrete

solutions to barriers affecting health information exchange (HIE) for treatment purposes

between participating States. The UM HIE States identified several significant potential

solutions necessary to alleviate barriers to exchange at the point of care between

Minnesota and its neighboring States. The identified barriers stem largely from the

variability of State consent-to-disclose requirements, including the Minnesota Health

Records Act, which requires expressed consent for the release of patient records, even

for treatment purposes, and consent requirements in other UM HIE States related to

special and sensitive services health information.

After considering the degree of impact and the potential value of the potential solutions

to patients and providers, the group pursued the creation of a Common Consent to

Disclosure2 Form and instructions/policies for use by providers in both paper and various

electronic environments. The value of this proposed solution was enhanced by the

decision to incorporate provisions designed to comply with varying State consent

requirements as they relate to sensitive or special information.

During the project, the UM HIE Consortium developed three distinct workgroups: the

Common Consent Form Workgroup, Electronic Transmission Workgroup, and Policy

Alignment Workgroup. Each group developed a charge document, which listed the

objectives, deliverables, and timeline for completing the necessary work.

The Common Consent Form Workgroup created three tools: (1) a Common Consent

Form, (2) a Consent Matrix that is a quick and easy reference for providers about when

the form must be used, and (3) a Request for Health Information Form that identifies the

information sought by the requesting provider and gives the disclosing provider

information about the requesting provider to help ensure the request is legitimate. In an

1 Original representatives from Iowa were unable to participate due to resource constraints. 2 This project addressed consent to disclose as distinguished from consent to treat requirements. References herein to ―consent‖ are to such consent to disclose unless otherwise specifically stated. (In some circumstances the term ―authorization‖ may be more appropriate.)






2

interstate exchange scenario where the exchange is made directly from provider-to-

provider,3 use of these tools would allow the provider to make the request and provide

necessary documentation of consent in a single step. In an interstate exchange scenario

where the exchange is brokered between health information exchange organizations,

these tools would establish the consent to disclose parameters that would drive the

underlying system-level decisions regarding the release of information.

The Electronic Transmission Workgroup worked on developing consensus to facilitate

electronic exchange of the consent tools. They explored converting the Common Consent

Form (currently paper-based) to operate in a fully electronic process for consent and

information exchange. The group developed potential strategies for implementing the

Common Consent Form in electronic information exchanges and worked closely with the

Policy Alignment workgroup to determine by group consensus the most feasible options.

The Workgroup then developed recommendations for implementing those options.

The Policy Alignment Workgroup explored the mechanisms the UM HIE States might

employ to encourage or require the use of the Common Consent Form and other tools.

The Workgroup identified three distinct mechanisms the States could consider for use in

the short term to facilitate implementation of the Common Consent Form to advance

health information exchange across borders: legislative or regulatory levers, market

levers, and informal levers. The Workgroup developed sample language and other

recommendations to facilitate the States’ implementation of the various levers.

The following tools and recommendations from each workgroup were circulated by the

UM HIE States to their stakeholders for review and input:

• Common Consent Form: This form facilitates the disclosure of any health

information, including information related to sensitive services, by incorporating

Federal and participant States’ requirements regarding authorizations to disclose,

along with guidance for use. It is to be used only for treatment, payment, and

health care operations purposes [as defined by Health Insurance Portability and

Accountability Act—HIPAA]. It can be used in both emergency and nonemergency

situations. In phase two of the project the workgroup may create (if so desired) a

consent form that includes the option to limit the release to certain kinds of

information.

• Electronic Transmission: After considering six possible strategies for capturing

and exchanging electronic consent, the group reached a consensus on two

methods: one focused on short-term and one focused on long-term solutions that

each participating State agreed were feasible and supportable. Short term, the

workgroup recommends the immediate adoption of the NwHIN Direct protocol to

transmit the necessary consent forms. Longer term, as each State builds its HIE

infrastructure the consent document should be transmitted and stored in a

document repository that uses the Integrating the Healthcare Enterprise (IHE)

consent management profile.

3 These documents may also be used in intrastate disclosures where consent/authorization is required. Throughout the document references are made to interstate data disclosure for simplicity, which is not intended to exclude intrastate use where appropriate.






3

• Policy Alignment: This workgroup identified potential strategies for

communicating about the tools and promoting their use. In the model used as

part of this project, each State requires specific communications and discussions

with their relevant stakeholder groups to determine which levers are appropriate

for execution in both the short and long term. Outlining the commitments made

to enact these various policy levers, as each State has done in this report, will

determine the path forward that meets the needs of each State.

By design, the UM HIE process was iterative and included a number of points at which

the group was asked to take stock of the project direction and planned work product.

This provided an opportunity to incorporate the group’s latest thinking and policy

decisions and assess feasibility to tailor deliverables for greatest value. The contents of

this report do not necessarily reflect the opinions or policies of ONC.

As the work progressed, the number of State-level stakeholders engaged in review of

the project’s products and direction increased, as did the frequency and intensity of their

engagement. Stakeholder engagement in the work and endorsement of the outcomes

were viewed as critical for gaining traction and having a practical impact on health

information exchange by ensuring alignment with Stakeholder’s needs. For this reason,

each State kept its State-designated health information technology (HIT) Coordinator

informed about the group’s progress and direction and in many cases, the HIT

Coordinator participated in UM HIE working meetings. In some States, representatives

from the State Attorney General’s office were also involved.

This report provides various tools and products as a resource for other States that wish

to engage in similar activities, or in a similar process including: (1) an environmental

scan the participants used, (2) the final Common Consent Form, (3) a consent matrix

and request for health information form, (4) the use cases the group created to guide

the discussion about how to execute the form, (5) a table on electronic consent options,

and (6) an inventory of policy alignment options. It is intended that an explanation of

both the tools, and the process the UM HIE States undertook to develop them, will be

valuable to and provide a starting point for similar initiatives in other regions.






4

2. Process to Identify Tools and Mechanisms to Advance Interstate HIE

In July 2010, RTI notified the UM HIE group of its intent to support their proposed

project. This section provides an overview of how the project’s structure progressed,

including a discussion of the factors that affected how and what decisions were made,

and the manner of reassessing the process, progress, and goals for the project.

Throughout August, RTI worked with the UM HIE participants to finalize the design and

overall work plan of the project. In September 2010, the UM HIE participants convened

an in-person kickoff meeting to discuss the appropriate scope of the work within the

project’s 1-year timeline, based on each State’s preliminary assessment of its legislative,

regulatory, policy, and legal environment. Each participant identified at least one primary

contact responsible for their State’s participation and input. For each State, RTI retained

a local Subject Matter Expert (SME) to assist in analyzing state privacy laws and provide

drafting expertise. RTI also retained an advisor to provide a higher-level, cross-State

perspective on privacy law. The primary contacts and the State SMEs were asked to

engage and participate in regular, ongoing meetings to advance more robust HIE across

State lines. The Consortium work plan consisted of nine tasks, including the creation of

necessary documents, mechanisms for execution, outreach and communication to

stakeholders, and administrative tasks.

2.1 Environmental Scan

At the kickoff meeting, the UM HIE participants determined that the initial objectives of

the group were to: (1) develop a Common Consent Form to be considered for use by the

participating States, (2) identify exchange barriers other than consent, (3) understand

existing sanctions for violations of patient consent requirements, and (4) develop an

understanding of current HIE development in each participant State. The first

substantive task was to collect information about these initial objectives from each State

in an environmental scan (see Appendix A-2). The environmental scan was intended to

establish a core base of knowledge to facilitate the development of the Common Consent

Form and create a foundation of common knowledge to support all of the project tasks.

A summary of the environmental scan responses that were submitted by each State’s

SME, is included as Appendix A-3. Notably, in addition to variations in State consent to

disclosure law and practice, the UM HIE participants identified the following as high-

priority challenges:

• Insufficient technical capabilities in currently available information systems

• Potential State-to-State disparity in provider liability risk

• Community culture-based reticence to release information

The environmental scan also revealed that the UM HIE States varied greatly in the status

of their efforts to establish State HIEs. This realization combined with the identified

technology challenges ultimately led the UM HIE States to move forward with their goal

of a Common Consent Form in stages: first, paper-based tools and recommendations, to

be followed by decisions and recommendations for transitioning to creation and

exchange of an electronic consent form.






5

Throughout September and October, the UM HIE participants identified and collected

resources to support the project tasks, including sample consent forms and relevant

work product produced by other initiatives (particularly previous HISPC and other ONC

projects). At regularly scheduled status meetings, the UM HIE participants summarized

and compared the information collected by each participant State. This work continued

to inform and help refine the UM HIE participants’ evolving ideas regarding (1) the

project’s ultimate ―solution‖ to address the barriers to HIE; and (2) the manner of

adopting and deploying their solution.

At the November 2010 status call the UM HIE participants assessed their work plan and

anticipated work product for feasibility and value. They reached consensus that the

ultimate goals of the project were to (1) enhance trust in HIE to promote broad

acceptance, and (2) develop specific use cases that arise in exchanges across State lines

so as to create the greatest value for the UM HIE States. But they also sought a specific

goal that would have value to a broader group. They agreed to create a common consent

to disclose form that addresses the special consent rules in each State about sensitive

information; a significant advance in interstate health data exchange for the UM HIE.

In December 2010, the group met via Webinar to discuss the environmental scan final

results. The issue of provider liability arose again and, although the group agreed that it

is important, they set the issue aside for several reasons. First, there is no difference in

provider liability between a paper environment and an electronic one. Second, the issue

is complex and would require time and resources beyond the scope of this project.

The group decided to continue developing the Common Consent Form, based on a model

from Minnesota that had been well-vetted among a wide variety of stakeholders who

might use the form in Minnesota. The Minnesota and Wisconsin teams began to develop

a form template for consideration by the UM HIE States.

2.2 Review of Potential Mechanisms for Interstate Agreement

At the December 2010 meeting the high-level, cross-State subject matter advisor, Baker

Donelson, presented initial comments about potential next steps based on the results of

the environmental scan and introduced discussion about potential mechanisms for

approval, promotion, and adoption by each State. Three types of potential solutions were

identified:

• interstate compact

• policy alignment

• uniform laws

The group discussed the high-level challenges and benefits related to each solution, and

the State representatives agreed to take the information back to stakeholders for their

consideration. Important factors in the decision about a mechanism were: (1) the time

frames imposed by the project as well as other State activities; (2) the political and

regulatory environment in each State; (3) the need for a partial approach (initially) to

secure the understanding and buy-in of key stakeholders; and (4) technical

requirements of the HIE systems in each State that still needed to be worked out.






6

To aid the discussion and decision about a mechanism, the participants prepared a

matrix of the options and factors for consideration for the States to use in this process4

(see Appendix A-1). This matrix evolved as the State representatives considered the

pros and cons of each mechanism, discussed them with their stakeholders, and assessed

the potential of each in realistic terms. In addition, the UM HIE participants reviewed the

work on interstate compacts completed by the HISPC Interstate and Intrastate Consent

Policy Options Final Report, found at:

http://healthit.hhs.gov/portal/server.pt?open=512&objID=1280&PageID=16054&mode

=2&cached=false.

At this point, it became clear that factors in each State mitigated against the pursuit of

an interstate compact—originally the anticipated product of the UM HIE Project. These

factors included:

1. the timing of legislative sessions (some State legislatures meet only every other

year);

2. the short time frame to gain support in each legislature;

3. the need for Congressional approval (assumed but not studied closely);

4. the need for more flexibility as the States work on other components of their

HIEs; a law, the outcome of the compact at the State level, is not a nimble

mechanism; and

5. the political climate, such as a recent change in administration or a change in

majority in the legislature.

During the December 2010 status call, members of the team working on the consent

template materials again raised the need to revisit the overall goals of the project and

expected end products. Although the team was almost certain that the compact

mechanism would be rejected in favor of policy alignment and contracts/procurement

(internal to the States) for the adoption of common forms and policies, the resources

and timeline for going forward were unclear. In addition, before approaching

stakeholders with a ―solution,‖ the UM HIE team needed to make additional progress

toward completing the tool, define key terms, and map out the process for outreach to

stakeholders. The work plan and time frames were adjusted accordingly.

The team made a key decision to use the UM HIE State representatives as the

stakeholder group for review and feedback on the initial drafts of the work product. The

State representatives would assess the best option and make a recommendation to the

broader stakeholder groups with which they are working, with explanations. They

solicited feedback to help refine the product and the process. In this way, the scope of

the tasks going forward was more focused, and the team could develop for their

stakeholders’ consideration clearer and more concrete tools, explanations, and policy

options.

This approach also had the added value of moving forward on a solution, rather than

waiting while the stakeholder input process was undertaken. However, in some States,

4 The attachment reflects four options. Baker Donelson added model/negotiated rulemaking as an option during the discussion. It is included in the attached matrix so that other States can assess its potential in their own circumstances.

http://healthit.hhs.gov/portal/server.pt?open=512&objID=1280&PageID=16054&mode=2&cached=false

http://healthit.hhs.gov/portal/server.pt?open=512&objID=1280&PageID=16054&mode=2&cached=false






7

team members engaged a wider group of stakeholders at this stage because appropriate

mechanisms for review and feedback were already in place. The team continued to

develop the Common Consent Form and the adoption mechanism matrix continued to

evolve as a discussion document.

2.3 Discussion and Agreement on Policy Alignment as Preferred Mechanism

During the January status call, the UM HIE participants discussed necessary definitions;

themes and issues with the content of the adoption mechanism matrix; and the process

for coming to final decision on the mechanism. During discussion of the mechanism by

which the work would be executed in each State, the consortium members began to

consider the highly relevant work of the Common Consent Form Workgroup.

Consensus was clearly building for a policy solution to be carried out through State

administrative activity and, potentially, procurement. Other State activities to establish

their HIEs were considered and potential overlaps with those activities were identified

that could be leveraged to promote the UM HIE Project solution.

Given that the States were focused on a policy option and that legislative action in any

State seemed out of the question, Baker Donelson suggested a hybrid mechanism for

consideration: the development of a ―model rule‖ or a negotiated rule that would adopt

the final solution without legislation. The UM HIE Consortium could develop the proposed

rule and each State would adopt its version. Although this option could give additional

certainty and enforceability, it was determined that the process of rulemaking involved

issues similar to those preventing adoption of a legislative solution and was dependent

on each State agency’s rulemaking authority. Unfortunately, time constraints hindered

full consideration of the option, and several States believed that the process would be

too slow in any event, even if they had authority to act. Therefore, consensus coalesced

around the policy alignment option despite problems with enforceability and certainty.

Although the participants recognized that other mechanisms have value, they would

have to wait for later phases of the project. Shortly thereafter, the group reached

consensus that the only viable path forward was policy alignment.

2.4 Development of the UM HIE Workgroups and Tools to Enable

Interstate HIE

From the January call and follow-on discussions participants decided to set up three

workgroups:

• Common Consent Form Workgroup—to focus on finalizing, as much as possible,

the Common Consent Form and related guidance.

• Electronic Translation Workgroup– to develop an approach and recommendations

for translating the Common Consent Form (and related policies) into electronic

format accessible to each State.

• Policy Alignment Workgroup—to develop policies and agreements related to the

Common Consent Form (including use case scenarios).






8

The workgroups met independently and reported back to the full group every 2 weeks,

to achieve rapid progress prior to the in-person meeting scheduled for March 2011. Each

workgroup had a focus, proposed work plan, deliverables, and resources. The

workgroups were effective initially but as time passed, progress was hampered by

interdependencies between workgroups and by incomplete representation of States in

some workgroups. Several participants attended two or more workgroup meetings,

which facilitated information sharing, and Baker Donelson attended most (if not all) of

the small and large group meetings, to provide support and guidance and ensure

alignment across workgroups.

The purpose of the March in-person meeting was to discuss and reexamine the

workgroup charges, deliverables, and timelines. Each workgroup brought the work they

had completed, and each State was asked by the Policy Alignment Workgroup to prepare

a review of potential mechanisms in their State to implement the tools being developed.

Thereafter, each workgroup continued to work through April and May 2011 to finalize

deliverables and develop materials for stakeholder education and outreach. States then

engaged in various stakeholder outreach activities through August and developed plans

for implementing the recommendations and tools as appropriate. The outcome of those

activities is presented in the remainder of this report.






9

3. Recommendations and Tools

This section of the report discusses the tools that the UM HIE Consortium developed—to

guide their ongoing discussion and decision making and to serve as a work product—

along with a commentary about context. While it is useful to be able to consider tools

like these when beginning similar work, other States and jurisdictions will be constrained

by the environment in which they are working just as the UM HIE States were. The

processes and working tools described here may be useful in determining how to address

challenging policy and implementation issues in other contexts. Recommendations for

other initiatives are also included for consideration. Section 5 includes recommendations

for future work to refine and expand the use of the tools that the UM HIE participants

developed.

The UM HIE States took care when they decided on the focus of their work. They wanted

both to address a real barrier to exchange and to find a solution with value to providers;

otherwise, it would not be accepted or promoted. The States had to see value as well,

and they had to feel comfortable ―endorsing‖ or promoting the solution and building it

into their new HIEs. Finally, the UM HIE participants considered the impact of the

solution being considered. If it works, how much will it advance the cause?

The UM HIE State participants agreed early in the project that developing a Common

Consent Form for the disclosure of health information that meets the privacy law

requirements in all participating UM HIE States would be a foundational step in

developing and implementing other tools and strategies to promote the HIE across State

lines. The approach and recommendations of the Common Consent Form Workgroup,

Electronic Translation Workgroup, and Policy Alignment Workgroup are described in

more detail below.

3.1 Common Consent Form Workgroup and Charge

The project team established the Common Consent Form Workgroup, with

representation from all UM HIE States. The workgroup was charged with using the

information collected in the environmental scan and other necessary resources to

(1) analyze all privacy laws in the UM HIE States that affect the disclosure of health

information in any situation; (2) use that analysis to determine which interstate

disclosures of health information a Common Consent Form would be targeted to

facilitate; (3) determine the State-law differences regarding consent requirements

affecting the targeted disclosures; and (4) develop a Common Consent Form and related

tools to facilitate the targeted disclosures.

3.1.1 Disclosures to be Enabled by the UM HIE Tools

3.1.1.1. Considerations

The threshold task in developing the Common Consent Form and other tools was

defining the scope and profile of the disclosures that the tools are intended to enable. To

arrive at its recommendations regarding scope, the Common Consent Form Workgroup

considered the following:






10

• What kinds of health information should be subject to disclosure through use of

the Common Consent Form (all health information; information related to

sensitive services; information related to minors)?

• Should the Common Consent Form be designed to facilitate disclosure for all, or

only some, purposes (treatment only; treatment, payment, and health care

operations only; litigation response; research, etc.)?

• What are the circumstances in which the Common Consent Form and/or other

tools should be designed to be effective (nonemergency; emergency)?

• What are the disclosure processes in which the Common Consent Form is

intended to operate (provider-to-provider without health information organization

(HIO) facilitation; HIO-to-HIO exchange)?

Several factors informed the Common Consent Form Workgroup’s recommendations on

the issues affecting the scope of disclosures: (1) the degree of conflict among State-law

consent requirements on a specific issue; (2) the state of development of each State’s

HIE infrastructure and governance; (3) the capabilities/limitations of implemented

technologies to enable electronic management of consent and transmittal of health

information; and (4) the time-frame of the current project.

3.1.1.2. Recommendations

The Common Consent Form Workgroup recommended, and the UM HIE participants

endorsed, a phased approach regarding the scope of the disclosures to be enabled by

the Common Consent Form and other tools. Specifically, the work of the UM HIE

Consortium to be completed in Phase 1 (for the period running through August 2011) is

designed to primarily facilitate disclosure of:

• any health information, including information related to sensitive services;

• for treatment, payment, and health care operations only (using HIPAA

definitions);

• in both nonemergency and emergency situations;

• through provider-to-provider (non HIO-facilitated) exchanges.

Work recommended to be completed in Phase 2 (for the period after August 2011)

includes modifying the Phase I Common Consent Form and tools (or developing

alternatives) to:

• address disclosures for purposes other than treatment, payment, or health care

operations;

• allow the patient to exclude certain kinds of information from disclosure; and

• address issues related to HIO-to-HIO facilitated exchange.

3.1.2 The UM HIE Tools to Enable the Interstate Exchange

3.1.2.1. Consent Matrix

The UM HIE Project team determined that when a provider needs to request a patient’s

health information from a provider in another State, the provider’s uncertainty about

whether that State law requires patient consent for the disclosure can create

inefficiencies in the exchange process. Thus, the UM HIE Project team developed the






11

Upper Midwest Consent Matrix (Consent Matrix) (see Appendix B-1). The Consent Matrix

is a single-sheet reference tool that allows a requesting provider in an UM HIE State to

determine ―at-a-glance‖ whether the health information he or she is requesting from a

provider in another UM HIE State triggers the requirement that the patient provide

consent for the disclosure. If consent is required, the requesting provider can use the UM

HIE Common Consent Form (Appendix B-2) and UM HIE Request for Health Information

Form (Appendix B-3) to make the request in a single step and to streamline the

disclosure process.

3.1.2.2. Common Consent Form

Instructions contained in the Consent Matrix inform a requesting provider that in cases

where the Matrix identifies the need for the requesting provider to get patient consent

for a disclosure from a provider in another UM HIE State, the provider can secure

effective consent by having the patient complete the Upper Midwest Common Consent

Form (formally titled the Upper Midwest Universal Patient Consent Form for Full

Disclosure of Health Information for Treatment, Payment & Healthcare Operations

Appendix B-2). As discussed below, the Upper Midwest Common Consent Form is

designed to enable electronic provider-to-provider exchanges using the Direct Project

Health Information Exchange Protocol (Direct Protocol) or a similar direct transmission

method. The UM HIE Project team recommends that a provider use the Direct Protocol to

transmit consent by attaching an image of the patient-signed UM HIE Common Consent

Form and sending it to the disclosing provider via Direct message. (See Section 3.2.1

Initial Recommendations on Electronic Transmission.)

Leveraging Prior Work

The Common Consent Form Workgroup reviewed work already undertaken by other

States to inform its development of the Upper Midwest Common Consent Form. In its

initial work, the Common Consent Form Workgroup used Minnesota’s Standard Consent

to Release Health Information form (which Minnesota has adopted for statewide use for

intrastate HIE) to help identify and address areas of commonality and conflict among the

UM HIE States about consent requirements.

As the UM HIE Project team refined the scope of disclosures to be facilitated by the

Upper Midwest Common Consent Form, the Common Consent Form Workgroup

determined that a form Florida developed and adopted by rule (the Universal Patient

Authorization Form for Full Disclosure of Health Information for Treatment & Quality of

Care) authorizes intrastate disclosures very similar in scope to the interstate disclosures

the UM HIE Project team decided to enable in its Phase 1 work.

The Common Consent Form Workgroup decided to leverage the Florida form as a style

and content template in developing the UM HIE Common Consent Form. Designing the

Upper Midwest Common Consent Form to be as similar as possible to a consent form

already in use also supports efforts to standardize consent forms across the country to

further mitigate interstate exchange barriers.






12

Significant Features

Consent requirements, particularly those concerning the disclosure of health information

related to ―sensitive services‖ (e.g., mental health, alcohol and substance abuse,

reproductive issues), vary greatly among the UM HIE States. This variation created

points of decision regarding the design of the Upper Midwest Common Consent form.

When a point of decision arose in the design process, the Common Consent Form

Workgroup was guided in its deliberations to reach consensus by the primary objective

of its Phase I work: to create a Common Consent Form that was simple to understand

and easily implemented to facilitate the greatest number of fully electronic health

information exchanges. The most significant features of the Upper Midwest Common

Consent Form are described below.

“All or nothing” consent. The Upper Midwest Common Consent Form is intended for a

patient who wishes to consent to the release of any of his or her health information. It is

not designed to allow a patient to consent to the disclosure of some, but not all, of his or

her information (for example, the disclosure of all information except for certain

sensitive information). Although this approach limits to a degree the circumstances in

which the form will be useful, it is nonetheless recommended for Phase 1 implementation

for the following reasons.

Most currently implemented consent management and electronic health record

technologies do not support the segregation of pieces of a health record (for example,

information regarding sensitive services) so as to permit customized consent and limited

disclosure in an automated, electronic process. Because the Upper Midwest Common

Consent Form is intended to facilitate electronic exchanges, by taking an ―all or nothing‖

approach, the form aligns with the current implemented electronic exchange capability.

Many users will opt for consenting to full disclosure and with this approach, the form

intended to facilitate those disclosures can be short, simple, and implementable in the

current electronic environment. (See Section 3.2 Initial Recommendations on Electronic

Transmission.)

Further work recommended for Phase 2 includes modifying or developing an alternative

Upper Midwest Common Consent Form that would allow a patient to exclude from the

consent certain kinds of health information and also authorize disclosure for purposes

beyond only treatment, payment, and health care operations. This form would

necessarily be longer and more complicated than the Upper Midwest Common Consent

Form for full disclosure because it would have to deal with a broader array of State-law

consent differences. It would also be used, at least initially, largely outside the

electronic-exchange context, because it would be used in many cases to authorize

(1) patient-initiated requests (2) of subsets of their entire health record (3) to third

parties who are not health care providers. The UM HIE Project team has already

completed work in Phase 1 as a foundation to the development of the ―limited

disclosure‖ form. In combination with the Upper Midwest Common Consent Form, the

limited disclosure form would provide a robust set of tools to facilitate interstate

exchange in a variety of contexts.

Information sources. The Upper Midwest Common Consent Form does not require a

patient to identify specific providers from whom health information may be disclosed.






13

Instead, it authorizes disclosure from ―all information sources‖ that may include (but are

not limited to) medical and clinical sources (hospitals, clinics, labs, pharmacies,

physicians, psychologists, alcohol and drug treatment programs, etc.). This approach is

recommended because it fosters efficiency: if, after a patient provides consent, the

treating provider becomes aware of another information source, he or she does not have

to secure another consent. This approach also facilitates an electronic search for all

records, even those from a provider the patient may have not thought to identify. The

Upper Midwest Common Consent Form provides explicit notice that some information to

be disclosed may be protected by Federal or State laws that prohibit the information’s

redisclosure without the patient’s express written consent, such as 42 CFR Part 2.

Purposes. Although primarily developed to facilitate the exchange of health information

for treatment purposes, the Upper Midwest Common Consent Form allows participants to

use the form for payment and health care operations purposes, as those terms are

defined under the HIPAA Privacy Rule. This decision was recommended by the Common

Consent Form Workgroup to ensure that entities obtaining authorization by utilizing the

form would be permitted to use and disclose health information to facilitate common

health care business functions such as billing, quality improvement activities, quality

reporting activities and clinical risk management and malpractice defense. The

workgroup did not intend this form to be used for marketing or fundraising purposes.

Effective period. The Upper Midwest Common Consent Form stipulates that consent is

effective until it is withdrawn in writing or until an expiration date specified by the user,

whichever comes first.

Note: Until 2010, Minnesota law prescribed a limit of no longer than 1 year for a

patient’s consent to disclose health information. While the amended statutory language

clearly eliminates the 1-year consent duration limitation, there is some question in the

Minnesota health information and privacy community whether the law change permits a

consent period of unlimited. Many of the UM HIE participants favored including in the

Common Consent Form a consent period of unlimited duration. But because it has not

been firmly established that such an unlimited consent period is permitted under

Minnesota law, the Common Consent form on its face provides the user the option to

indicate a specific date on which the consent period expires.

3.1.2.3. Request for Health Information Form

As discussed above, the Upper Midwest Common Consent Form is designed to secure a

patient’s consent to the release of any of his or her health information. Clearly, however,

in most cases where the Upper Midwest Common Consent Form is intended for use, the

requesting provider. For this reason, the UM HIE Project team has developed the Upper

Midwest Health Information Request Form (Health Information Request Form)

(Appendix B-3) to be used in tandem with the Upper Midwest Common Consent Form.

The Health Information Request Form is intended to collect and provide the disclosing

provider sufficient information about the requesting provider to reasonably assure the

disclosing provider that the request is legitimate and the disclosure appropriate.

Information contained on the Health Information Request Form includes:






14

• Requesting provider information (person/organization name, phone, address, fax,

e-mail)

• Information needed to identify patient (name, address, birth date, gender)

• Patient information requested (Continuity of Care Document (CCD) or other)

• Provider identification number (as an optional field)

It is expected that in practice, the kind of information likely to be transmitted through

the Direct Protocol (or similar direct transmission method) will be, because of file-size

limitations, the kind of summary information contained in a CCD. The form, therefore,

lists the CCD as the first choice for the information requested for disclosure.

The UM HIE Project team recommends that a provider who needs health information

from an UM HIE State (1) consult the Upper Midwest Consent Matrix to determine if the

required disclosure triggers a requirement for patient consent; (2) request that the

patient complete the Upper Midwest Common Consent Form (if consent is required);

(3) complete the Health Information Request Form; and (4) use the Direct Protocol to

transmit the Health Information Request Form, along with the patient-completed Upper

Midwest Common Consent Form (if needed), by attaching images of the documents and

sending them to the disclosing provider via direct message. (See Section 3.2 Initial

Recommendations on Electronic Transmission.)

3.1.3 UM HIE Tool Implementation: Common Scenarios

The following paragraphs describe common scenarios in which use of the Consent Matrix,

Upper Midwest Common Consent Form, and Request for Health Information could be

used to enable the interstate disclosure of health information from an UM HIE State.

3.1.3.1. Provider-to-Provider Disclosure for Treatment Purposes in

a Nonemergency Situation

An adult patient living in Illinois sees a specialist at the Mayo Clinic in Minnesota. When

the patient returns to Chicago after his trip to Mayo, the patient’s primary care physician

decides she would like copies from Mayo regarding the consultation and proposed

treatment plan. To obtain this information, the primary physician (or her staff) consults

the Consent Matrix and determines that Minnesota requires patient consent for

disclosure of general treatment information. The physician’s staff provides the patient

the Upper Midwest Common Consent Form to complete and sign. The staff also

completes the Request for Information Form, specifying the information the physician

would like Mayo to disclose. The staff then uses the Direct Protocol to send a request for

information to Mayo, attaching images of the Upper Midwest Common Consent Form and

the Request for Health Care Information.

3.1.3.2. Provider-to-Provider Disclosure for Treatment Purposes in

an Emergency Situation

An adult patient living in South Dakota is vacationing in North Dakota when she is in an

accident. The patient is HIV positive and receives care from an infectious disease

specialist in South Dakota. The emergency department physician in North Dakota would

like to see copies of records from the infectious disease specialist to see what kinds of

medications the patient is currently on. To obtain this information, the emergency






15

department staff consults the Consent Matrix and determines that South Dakota requires

that consent be obtained from the patient (or her legally authorized representative)

before any health information related to HIV/AIDS can be disclosed, even in an

emergency situation. The staff provides the patient (or her legally authorized

representative) the Upper Midwest Common Consent Form to complete and sign. The

staff also completes the Request for Information Form, specifying the request for the

patient’s medication history. The staff then uses the Direct Protocol to send a request for

information to the infectious disease specialist, attaching images of the Upper Midwest

Common Consent Form and the Request for Health Information.

3.2 Electronic Transmission Workgroup and Charge

The Upper Midwest HIE Consortium formed the Electronic Consent Workgroup to

investigate and analyze ways to translate the UM HIE Common Consent Form into an

electronic format, and identify recommendations to facilitate the electronic exchange of

the consent a provider in an UM HIE Consortium State needs to be able to release a

patient’s health records to a provider in another UM HIE Consortium State. The

workgroup initially met with representatives from Minnesota, North Dakota, and South

Dakota. As the work of the group evolved, additional representation was sought from

Wisconsin and Illinois to participate in deliberations on the group’s recommendations.

The workgroup met four times in 3 months to:

• Develop a model of how consent could be transmitted electronically in a direct

exchange environment and in a facilitated HIE environment to identify additional

questions and considerations for interstate policy alignment purposes.

• Develop a list of key questions to discuss with various entities currently

conducting HIE in the UM HIE Consortium State; participants to identify existing

processes and mechanisms they are using to share consents or other health

record information electronically.

• Discuss and develop recommendations to be considered by the UM HIE

Consortium and ONC when implementation of electronic consent and consent

management becomes feasible.

3.2.1 Initial Recommendations

The workgroup asked two subject matter experts, Noam Arzt and Mike Berry, to help

review the workgroup’s deliverables and analyze the IHE Profile and Data Segmentation

in Electronic Health Information Exchange White Papers to identify trends and

recommendations for translating the paper UM HIE Common Consent Form into an

electronic format.

Based on the consent model developed by the Common Consent Form Workgroup, the

key questions facing UM HIE States and the current national environment of HIE, Arzt

and Berry identified six strategies to capture and exchange electronic consent (see

Appendix A-6) and identified the capabilities, strengths, and weaknesses for each option.

The strategies were outlined in a sequence of progressively more advanced options in

terms of the technology and standards necessary to support the exchange of consent

documents.






16

After review and deliberation of the six strategies, the workgroup decided to move

forward on two strategy recommendations to the Policy Alignment Workgroup for UM HIE

States to implement sequentially or simultaneously as they develop their interstate HIE

strategies. They are:

1. UM HIE States should immediately adopt a strategy that uses the Direct Protocol

to transmit consent, in which the requesting clinician will attach an image of the

patient-signed consent and send it via direct message to the disclosing entity.

2. In the near-term, as UM HIE States move forward in building their infrastructure

for a more robust HIE, they should adopt Strategy #5, in which a Consent

document is submitted and stored in an IHE-compliant document repository.

3.2.2 Implementing Recommendations

To implement these recommendations, the workgroup recognized the importance of

incorporating the standards required by each option into the technical infrastructure in

each State. Because all UM HIE States are currently in various stages of their

procurement processes to develop technical infrastructure for HIE, the workgroup

authorized Noam Arzt to enumerate the standards required by Strategies 3 and 5 for use

as a resource as States write their RFPs and negotiate vendor contracts. the following

text provides sample language about the core implementation requirements that may be

included in consent RFP instructions.

Sample Language: for Electronic Consent RFP Instructions

For Strategy #3:

Requires support for Direct protocol, including the ability to scan, attach, and

send consent documents to releasing clinician in a secure manner. No central

storage of consent documents is required or expected.

For Strategy #5:

Core implementation:

1. Requires support for the Integrating the Healthcare Enterprise (IHE) Cross-

Enterprise Document Sharing (XDS.b) Integration Profile. Specifically, XDS.b

Document Repository and Document Registry transactions (defined in IHE ITI TF-

1:10.1) should be used to register, store, and allow query and retrieval of

consent documents.

Submitting consent:

1. A provider EHR-S with IHE XDS and Basic Patient Privacy Consents (BPPC)

capability should be permitted to submit consent agreements as BPPC documents

to the document registry/repository. Each BPPC document will represent an

individual patient consent agreement and will optionally contain a scanned image

of a patient’s signed consent. Each type of written consent agreement should be

assigned a policy number (OID) to be used in corresponding BPPC documents.






17

2. Providers without IHE XDS and BPPC capability should be offered alternate

methods to submit representation of consent and scanned images of signed

consent documents, such as via (NwHIN) Direct attachments, a Web-based portal

or a mobile application. Some metadata, such as patient name, address, and date

of birth, should be required for these submissions.

3. A consent sent via one of the alternate methods should be automatically

converted to a BPPC document and submitted to the XDS registry/repository on

behalf of the sender. The BPPC document containing a scanned consent image is

described in IHE ITI TF-3: 5.1.3; the BPPC without a scanned image is IHE TF-3:

5.1.2. Both are constraints on the HL7 Clinical Document Architecture (CDA).

Access to the consent repository:

1. In addition to providing access via IHE XDS, alternate access to the consent

repository should be offered, such as via a Web-based portal or mobile

application.

3.3 Policy Alignment Workgroup and Charge

Through the UM HIE Policy Alignment Workgroup, the State participants agreed that

establishing an interstate Common Consent Form that meets the privacy law

requirements in all (and any) participating UM HIE States about consent/authorizations

required for disclosure of a patient’s health information, if needed for treatment,

payment or health care operations, would be a key tool to remove barriers to the

exchange of health information across State lines. The UM HIE States acknowledge that

each State has a unique environment in which it is developing its HIE infrastructure and

plans for a robust exchange of health information, and ways to incorporate the

availability. Decision makers should seriously consider using the UM HIE Common

Consent Form in State development plans to effectively advance interstate HIE.

The second key policy alignment component for this phase of the UM HIE Project focused

on what the State participants can accomplish in the short term to advance HIE across

their borders. Recognizing that none of the State participants is yet in a position to

determine definitively how the UM HIE tools will fit into its comprehensive State-

designated entity HIE infrastructure (e.g., HIO-to-HIO facilitated exchange, etc.), each

State acknowledged that it has plans to include the Direct Protocols as a method to

exchange health information, at least in the initial stages. Based on this commonality,

the UM HIE States reached consensus that they would seek ways to encourage the use

of Direct Protocols to attach and send a copy of a signed consent/authorization where

needed under State law for the disclosure of a patient’s health information for treatment,

payment, or health care operations.

Each of the UM HIE States has agreed to develop its own State Action Plan to encourage

the use of the Common Consent Form, the Consent Matrix, and other tools the UM HIE

Project team developed (―UM HIE Tools‖) within the parameters of its evolving HIE

infrastructure. To assist the UM HIE States in developing their State Action Plans, the

Policy Alignment Workgroup identified possible mechanisms or levers that States could

consider, develop, and use to accomplish this task (see Appendix A-7). The following

sections discuss the possible mechanisms and levers that States could use to promote






18

and implement the UM HIE Tools to facilitate the HIE across State lines. In particular,

the States noted that having template or sample language for legislative or regulatory

amendments, contracts and agreements with State vendors or contracting partners, and

educational initiatives and stakeholder endorsements would assist them in their efforts

to align policy statements and initiatives to facilitate the interstate exchange of health

information.

3.3.1 Legislative or Regulatory Policy Levers

Initial discussions among the UM HIE States identified significant challenges with

initiating any changes in State requirements by proposed legislation or rulemaking

efforts, given the economic, political, and privacy advocacy environments in each of the

States at the time the UM HIE Consortium Project began in August 2010. However, to

the extent that the States experience environmental changes in the years ahead, the

States acknowledged that having sample language for legislative or rulemaking

initiatives would be a valuable tool to accomplish comprehensive amendments in their

State laws and regulations.

3.3.1.1. State Approval of Common Consent Form

One key area where similarity or uniformity in State laws or rules could assist with policy

alignment involves establishing a process by which the State would approve the UM HIE

Common Consent Form for use in that State, whether from providers within the State or

from providers in States where the UM HIE Common Consent Form is approved for use.

By instituting a formal way for the State to confirm that the Common Consent Form

meets that State’s legal requirements, and that a provider using or receiving the

Common Consent Form can rely on the form to meet all the requirements for a patient

to authorize the disclosure of his or her health information, providers and other

interested parties will be more likely to trust and use the UM HIE Common Consent Form

as the standard default method for verification of consent. One way to accomplish this

task is to use the following sample language for a legislative or regulatory amendment:

Sample Language: Statutory /Regulatory Approval of

Consent/Authorization Forms

The [Agency Head/Commissioner/State Authority] shall develop a form that may

be used by a patient to authorize the disclosure of that patient’s health records to

a provider in this State [or in other States approved by the State authority] for

treatment, payment or health care operations purposes. A consent/authorization

to disclose form developed or approved by [the State Authority] under this

section from a provider within the State or from providers in States where the UM

HIE Common Consent Form is approved for use shall be accepted by a provider in

this State as a legally valid request for disclosure of health information, if

properly executed by the patient authorizing the disclosure of that patient’s

health information.






19

Sample Language: Placed on UM HIE Common Consent Form Indicating

Approval by State

The [Agency Head/Commissioner/State Authority] has approved the UM HIE

Common Consent Form for use in this State. Providers receiving a properly

executed form by a person authorized to request disclosure of a patient’s health

information may rely on this consent/authorization form to meet the

requirements for disclosure of health information under [State law].

3.3.1.2. Liability Protections

In some States and in some practice communities, providers may be concerned about

the liability to which they may be exposed if they use or rely on a consent/authorization

form that has not been created or approved by their own entity or legal counsel. To

advance the electronic exchange of health information and build trust for the use of the

UM HIE Common Consent Form, some States may need to enact legislation or

promulgate regulations to establish liability protections for providers who intend to use

or rely on the UM HIE Common Consent Form for the use and disclosure of protected

health information.

The UM HIE States determined that although liability concerns could include issues

related to the accuracy and completeness of the health information submitted in

response to an authorized request for protected health information, these questions and

issues are outside the scope of the current UM HIE Project work. Indeed, they are issues

with any health data exchange and use, regardless of medium, and so not unique to the

electronic exchange environment. The potential liability a health care provider faces for

improperly using or disclosing protected health information, i.e., violating HIPAA, or the

liability for failing to properly review a patient’s medical history, i.e., potential

malpractice allegations, will not differ significantly based on whether the information

exchange was interstate or intrastate or whether the information was transmitted

electronically or via paper records emailed between parties. Arguably, any differences in

exposure would be created by other facts that may exist because of the interstate

exchange, and not because of the medium used. These would be questions of fact, not

law.

While the Participants generally accepted this analysis, the use of a Common Consent

Form like that developed by the UM HIE Project is a major development. Therefore, in

this initial phase, the UM HIE Project focused on the potential risks perceived by

providers for sanctions that could be imposed for the release/disclosure of health

information under State or Federal privacy laws, based on their use of the UM HIE

Common Consent Form.

Sample language is provided (in the following box) as a starting point for States that

want to address these potential or perceived liability concerns in their statutes or

regulations. The first section contains language the Consortium agreed to in an attempt

to address liability issues related to the use of a standardized consent/authorization

form. The second section contains sample language establishing broader liability

protection for providers acting in good faith to release/ disclose health information as






20

part of a State’s HIE program. Each State would need to evaluate its ability to enact the

following language.

Sample Language: Immunity for Reliance on Interstate Common Consent

Form

A health care provider that relies in good faith on a properly executed

consent/authorization from a patient for the release of his or her health records

using [the Upper Midwest Health Information Exchange (UMHIE) Common

Consent Form] [an interstate Common Consent Form approved for use in this

State] is immune from criminal or civil liability arising from any damages for the

release of that patient’s health information caused by that good-faith reliance.

The immunity granted under this section does not apply to acts or omissions

constituting gross negligence or reckless, wanton or intentional misconduct

related to the reliance on such form, nor does it create immunity from liability for

other acts on the basis that data are disclosed or used based on such form.

Sample Language: Immunity for Reliance on Data from Health

Information Exchange

A health care provider that relies in good faith upon any information provided

through the health information exchange in the treatment of a patient is immune

from criminal or civil liability arising from any damages caused by that good-faith

reliance. The immunity granted under this section does not apply to acts or

omissions constituting gross negligence or reckless, wanton, or intentional

misconduct.

For purposes of this section, the term “health information exchange” means [refer

to the State Designated Entity’s (SDE) authorized health information exchange

program and/or direct exchanges allowed or conducted in compliance with the

SDE’s program] including exchanges of health information made with providers in

other States as authorized by the [State] SDE.

3.3.2 Market Levers

Recognizing that statutory or regulatory changes may not be easily accomplished in the

near future to allow for policy alignment among the UM HIE States, the UM HIE State

participants identified alternative methods to encourage or require the use of the UM HIE

Tools to overcome current consent-related challenges to interstate HIE. Each State

acknowledged that the potential exists for incorporating the use of the UM HIE Tools into

its State-contracting processes, including contracts with providers and other entities that

provide health related services in its State.

Some examples of these market levers are:

• Contracts with State-Designated Entities and/or State-authorized HIOs, requiring

these entities to use and encourage, and actively foster the UM HIE Tools.






21

• Requests for Proposals (RFPs) for entities seeking to conduct business with the

State, establishing the use of the UM HIE Tools as a submission requirement for

qualified responders to the RFP.

• State contracts with health care providers authorized to provide services under

the State’s Medicaid program, requiring those providers to accept and use the UM

HIE Tools.

• State contracts with health plans to operate Medicaid managed care or disease

management programs.

• State employee health benefit contracts, requiring entities providing services

under these contracts to State employees to agree to accept and use the UM HIE

Tools.

The UM HIE States appreciate the fact that each State has a unique set of circumstances

that it must address, given the current development of its HIE infrastructure and the

State-specific processes used to execute contracts for services. To facilitate and expedite

policy alignment among the States using these market levers, the Policy Alignment

Workgroup developed template language for States to use in their RFPs and contracting

processes, as may be permitted or deemed desirable in each of the States.

3.3.2.1. Language in RFPs or Contracts with State-Designated

Entities or Health Information Organizations

To implement their strategic and operational plans under the HITECH Section 3013

Funding from the Office of the National Coordinator (ONC), State grantees are

developing their HIE infrastructures and establishing policies, procedures, and contracts

with entities and/or vendors that will provide HIE services in their States. These entities,

including State-designated entities and State-authorized health information

organizations (collectively referred to as ―State-authorized HIE Service Providers‖), will

be in a strategic position to help advance interstate exchange of health records, given

their centralized role in the State’s HIE infrastructure.

State-authorized HIE Service Providers can take an active role in publishing, circulating,

and encouraging the use of the UM HIE Tools in their State. As HIE infrastructures are

developed and refined, providers will look to these State-authorized HIE Service

Providers as a centralized source for recommended procedures and best practices,

including how to securely exchange patient health information with providers in other

States.

The UM HIE Policy Alignment Workgroup developed the following sample language for

States to incorporate into their RFPs and State contracts to encourage or require State-

authorized HIE Service Providers to make the UM HIE Tools readily available to providers

in their State. As educational and instructional materials are developed, the materials

will also be made available to the State-authorized HIE service providers who will be in a

position to advise providers on ways to efficiently and effectively exchange patient health

information with providers in other States.






22

Sample Language for RFPs and State Contracts: Use of the UM HIE

Common Consent Form

The [RFP Responder or Contractor] agrees that it will establish a system

encouraging or requiring providers using the [Contracted Services] to accept the

Upper Midwest Health Information Exchange (UM HIE) Universal Common

Consent Form as a legally valid patient authorization for the disclosure of health

information on that patient, and to use the UM HIE Universal Common Consent

Form as may be appropriate for obtaining health information on patients from

providers in States where the UM HIE Universal Common Consent Form is

approved for use

Sample Language: for Electronic Consent RFP Instructions

See section 3.2 above

3.3.2.2. State Purchasing Power—State Medicaid Provider

Contracts

All UM HIE States were willing to consider discussions about incorporating provisions into

their State Medicaid provider contracts to require or encourage the contracted providers

to use and accept the UM HIE Tools in the exchange of health information within the

State and with providers in other UM HIE States. Following is sample language the

States can use as a starting point for including these practices into their Medicaid

provider contracts.

Sample Language: for Compliance

As a condition to participate in the [Insert State] Medicaid Program, the Provider

agrees that it will comply with all applicable provisions of statutes, rules, and

Federal regulations governing the providing of healthcare and reimbursement of

services and items under Medicaid in [Insert State] including the current

applicable Medicaid Provider Handbook and any instructions contained in provider

information releases or other program notices. The Provider specifically agrees

that it is required to comply with:

[references to title VI of the Civil Rights Act of 1964, the Health Insurance

Portability and Accountability Act (and the HIPAA Privacy and Security Rules), The

Age Discrimination Act, the Americans with Disabilities Act, the [Insert State]

Human Rights Act, the Social Security Act, section 504 of the Rehabilitation Act of

1973… The Medicare-Medicaid and I Fraud and Abuse Amendments of 1977]






23

All standards, specifications, and requirements applicable to the storage and

transmission of electronic health information stored in, disclosed to, or

transmitted by the [Insert State] health information exchange and all rules for

the use of health information, use of the health information exchange, and

participation in the health information exchange, including the requirement of

[Insert State Statute] that a provider: (a) may use only an electronic health

record system for use in the health information exchange which is certified under

rules adopted by the Federal Office of the National Coordinator for Health

Information Technology, and (b) shall accept the Upper Midwest Health

Information Exchange (UM HIE) Common Consent Form as a legally valid patient

authorization for the disclosure of health information on that patient, and will use

the UM HIE Common Consent Form as may be appropriate for obtaining health

information on patients from providers in States where the UM HIE Common

Consent Form is approved for use.

Similarly, States should explore their ability to include similar language in their contracts

with health plans administering Medicaid managed care or disease management

programs.

Unfortunately, it is not possible for a State to reach similar agreements through Medicare

programs operating within its borders. The UM HIE participants recommend that the U.S.

Department of Health and Human Services monitor the use of Common Consent Forms

and actively engage as a participant when these forms are adopted.

3.3.3 Informal Policy Levers

As part of its policy alignment analysis, the UM HIE Policy Alignment Workgroup

conducted a survey of the participating States to explore what mechanisms might exist

or be implemented among the States to incorporate the UM HIE Tools into the

operational components of a State’s HIE infrastructure. In addition to the market lever

mechanisms discussed above, the UM HIE States identified potential methods to promote

the use of the UM HIE Tools, including:

• developing education materials for providers about benefits of using the UM HIE

Tools;

• partnering with hospital associations and provider associations to endorse the

work of the UM HIE Project and encourage the use of the UM HIE Tools;

• engaging with State bar associations, especially the health law sections, to

develop outreach and education for provider counsel and to promote the use of

the form;5

• patient advocacy groups, such as those for families of children with special needs

and mental health groups that particularly need more streamlined consent and

data exchange policies and practices; and

• health plan associations, to support education and outreach to adopt similar tools.

5 The State bar association health law section should be included in stakeholder engagement early on; they will have significant influence on the implementation portion of the project.






24

3.3.3.1. Interstate Agreements

In addition, some States indicated a willingness to develop and execute an interstate

agreement between two or more State agencies or State-authorized entities to establish

mutual expectations for use of the UM HIE Tools for interstate health information

exchange.

Because the initial phase of the UM HIE Project is focused on using direct exchange of

the UM HIE Tools between providers in different States, the development of a template

interstate agreement will be deferred to future phases of the UM HIE Project, when the

State participants will be working on interstate exchange of health information facilitated

by the State-designated entities or State-authorized HIOs.






25

4. State Action Plans for Stakeholder Engagement and to Promote Adoption

Each of the UM HIE States was charged with developing an action plan to encourage use

of the UM HIE Tools in the State (State Action Plan). Each State Action Plan addresses

such issues as: (1) how the State will make the UM HIE Common Consent Form and

other UM HIE Tools available to providers; (2) the State’s approach to educating

providers on how the UM HIE Common Consent Form and other UM HIE Tools can be

used to enable interstate HIE, and (3) the State’s strategy for aligning its policies with

those of the other participant States to ensure providers’ acceptance and use of the UM

HIE Tools.

In developing its State Action Plan, each State evaluated the efficacy of adopting the

various implementation levers described in Section 3.3 (above), including (1) legislative

or regulatory policy levers (i.e., agency policy action, legislation, or rulemaking);

(2) market levers (i.e., vendor contract terms mandating the use of the UM Tools); and

(3) informal levers (i.e., provider education and outreach).

A key component to the State Action Plan development process was each State’s

securing input from its key stakeholder groups to inform the State Action Plan’s design

(described in the following section)6. The State Action Plans are attached as Appendix C.

4.1 Illinois Process to Engage Stakeholders

The Illinois Health Information Exchange Authority (Authority), a new State of Illinois

agency charged with developing and implementing a State-level health information

exchange in Illinois (ILHIE), was appointed in 2011. The Authority is governed by a

Board with nine members representing a broad range of statutorily identified

stakeholders, and five ex-officio members representing agencies within State

government. By fall 2011, the Authority will appoint a statutorily mandated Advisory

Committee to provide the Authority advice from a broad range of additional stakeholders

in Illinois. By the start of 2012 the Authority, together with its Advisory Committee,

hopes to begin addressing policy issues about the development and implementation of

the ILHIE, including those concerning the interstate exchange of protected health

Information. By that time, the Authority will have the benefit of the recommendations of

the State of Illinois Office of Health Information Technology (OHIT), a bureau within the

Office of the Governor, following its selection of a vendor for the technical

implementation of the ILHIE’s core services, and following the receipt of a report from

legal SMEs regarding legal and policy obstacles in Illinois to the development and

implementation of the ILHIE.

The State of Illinois has not committed to adopt or promote the Common Consent Form

(or any other UM HIE Tools); because of the stakeholder engagement reasons set out

above, a State of Illinois decision regarding the Common Consent Form is being

deferred, and the State of Illinois reserves the right in its discretion to decline to adopt

or promote the Common Consent Form. The principal criteria that Illinois will use in

6 Given the timeline of the Illinois HIE body to review policy related issues, they are unable to provide a State Action Plan at the time of this report.






26

making that determination are set out in Appendix A-7. The State of Illinois HIT

Coordinator in her professional discretion will at the appropriate time engage the

appropriate Illinois stakeholders to further the health care interests of the residents of

Illinois, which include promoting improved patient care, improved population health, and

lower health care costs.

4.2 Minnesota Process to Engage Stakeholders

The Minnesota Strategic Plan and Operational Plan for Health Information Exchange

(HIE) describe the process used in Minnesota to actively and effectively engage and

consult with stakeholders in all aspects of HIE through the Minnesota e-Health Advisory

Committee and its workgroups. The Minnesota e-Health Advisory Committee, comprising

representatives from many stakeholder groups, was established by Minnesota statute in

2005 to advise the Commissioner of Health on the adoption, implementation, and

effective use of health information technology to improve patient care and reduce cost of

care in Minnesota. The e-Health Advisory Committee reviews and develops policy

recommendations for the Commissioner of Health, including those included in an annual

report to the Minnesota Legislature. The Minnesota Privacy, Legal and Policy (PLP)

Workgroup is the lead workgroup coordinating the development of policy

recommendations related to e-health, including privacy and legal matters to enable

statewide and interstate HIE. The PLP Workgroup, comprising representatives from

interested stakeholder groups, actively monitored, assessed, and commented on the

work of the UM-HIE Collaborative during the course of the project.

Members of the PLP Workgroup provided thoughtful comments about how the Common

Consent Form must be amended to meet Minnesota privacy and consent laws, especially

with respect to the duration of the consent. Assuming that the Common Consent Form is

amended to address its concerns, the PLP Workgroup agreed that the UM HIE Tools

would be valuable resources to (1) advance the electronic exchange of patient health

information with providers across State borders to enhance patient treatment and care;

and (2) continue to safeguard the right of patients to control access to their patient

health information. In July 2011, the PLP Workgroup agreed on recommendations to be

submitted to the e‐Health Advisory Committee for its review and endorsement. The

Recommendations of the PLP Workgroup will be presented to and considered by the

Minnesota e‐Health Advisory Committee at its meeting on September 26, 2011.

4.3 North Dakota Process to Engage Stakeholders

The UM-HIE Common Consent Form, electronic consent protocol, and policies and

procedures to implement utilization of the UM-HIE universal consent form were referred

to the North Dakota Health Information Technology Advisory Committee’s (HITAC’s)

Legal and Policy Domain Team for that team’s review and consultation with additional

representative stakeholders. The Domain Team made a recommendation to the North

Dakota HITAC (North Dakota’s officially designated agency for the development of HIT

and HIE policy) regarding adoption and use of the universal consent form. The North

Dakota HIE strategic and operational plan document explicitly refers to the RTI UM-HIE

Consortium Project (in section 5.5 Bordering State Laws) and use of Consent Forms and

Agreements (in section 6.1 Forms and section 6.2 Agreements).






27

4.4 South Dakota Process to Engage Stakeholders

In spring 2008 the South Dakota Governor’s Health Care Commission established the

South Dakota eHealth Collaborative to develop a long-range plan to facilitate

implementing interoperable information technology to improve the quality, safety, and

efficiency of health care in South Dakota. The SD eHealth Collaborative has active

members from several key groups, including physicians, patients, State legislators,

insurance companies and other payers, State and local government officials, health

information managers, lawyers, and project administrators. The SD eHealth

Collaborative and its work groups provided avenues for stakeholder review and comment

of the UM-HIE Collaborative work. In June 2011, Kevin DeWald, the State Government

HIT Coordinator for South Dakota presented the UM HIE Preliminary Report to the South

Dakota Secretary of Health, the South Dakota Meaningful Use Coordinator for Medicaid

and the Director of the Regional Extension Center in South Dakota. In July 2011, Kevin

DeWald and Richard Puetz, the South Dakota State SME on this project, presented the

UM HIE Report to the South Dakota eHealth Collaborative.

4.5 Wisconsin Process to Engage Stakeholders

Wisconsin engaged the Wisconsin Statewide Health Information Network (WISHIN) (its

State-Designated Entity for HIE governance). WISHIN explored whether it can use the

Common Consent form. The WISHIN Policy Committee reviewed recommendations and

policies regarding this form to decide whether to endorse its use.

As one of WISHIN’s action items, they obtained feedback from some members of the

HIPAA COW (Collaborative of Wisconsin) Privacy Networking Workgroup. HIPAA COW is a

nonprofit organization formed as a result of a joint effort of the Wisconsin health care

organizations. HIPAA COW serves as a resource to covered entities and their business

associates. It also sponsors two conferences each year and provides a Web site with

various HIPAA/Wisconsin template forms and policies.

WISHIN is presently not ready to endorse the use of the Common Consent Form and

would like feedback from Wisconsin providers about the usefulness of the form before

considering an endorsement. Wisconsin is interested in piloting the UM HIE tools with

some of its providers for patients living near the border that go to health care facilities in

both Wisconsin and the neighboring state. WISHIN will re-evaluate its position based on

the results of the Pilot. (Please refer to Appendix C-4 for more information). Also

depending on the results of the pilot, the Wisconsin Department of Health Services

(DHS) will consider whether it can use and endorse this form (as it has done with an

Advance Directive form) and make it available to the public on the Department’s Web

site or whether the Medicaid program could use this as an agency-endorsed form with

their contracted providers.






28

5. Recommendations for Future Work and Considerations

The work to date of the UM HIE Consortium provides specific recommendations on what

the group believes is a feasible approach to enable interstate HIE, given the existing

policy frameworks, political environments, and HIE capacity of each UM HIE State.

This initial work is intended as an incremental step focused primarily on (1) establishing

a common understanding of the consent requirements for releasing providers in each

State, (2) developing a common tool for consent that is sufficient to meet the needs of

releasing providers in all UM HIE States, (3) providing recommendations on the process

for transmitting a request with necessary documentation of consent to a known provider

in another UM HIE State, and (4) providing recommendations for policy alignment to

ensure that the UM HIE Common Consent Form and related tools are available,

recognized, and accepted by releasing providers to enable interstate HIE.

This work has also pointed to several issues where future work will be needed (1) to

ensure that the UM HIE Tools remain current as State environments for HIE continue to

evolve, and (2) to address key considerations that arise as UM HIE States implement

their strategic and operational plans for health information exchange.

5.1 Proposed Process to Ensure UM HIE Tools Remain Current

The UM HIE States recognize that over time, changes to State and Federal law and

developments in technology and processes for HIE could cause the UM HIE Tools to

require modifications. To ensure that UM HIE tools are kept up-to-date, the UM HIE

States7 plan to use the following process:

• UM HIE States will convene annually for at least the next 2 years to review the

Common Consent Form, the Consent Matrix, and the Request for Information

Form to ensure that any modifications to State or Federal consent laws are

incorporated and that the UM HIE Tools are updated to sufficiently address the

evolving needs of releasing providers in each State.

• The Minnesota Department of Health’s Office of Health Information Technology

has agreed to take the lead in organizing the annual meeting of the UM HIE

Consortium States. Initially, the UM HIE States will convene a conference call

during July 2012 to evaluate what changes to the Tools or actions might be

needed to accomplish this task.

• Each UM HIE State has agreed to identify appropriate legal staff to participate in

the annual legal review of the UM HIE Tools to ensure that they adequately

address the needs of releasing providers in their State. Each State has further

agreed to take any subsequent action necessary to garner stakeholder support

and educate providers on updates to the materials.

7 As noted in Section 4.1 above, the State of Illinois has not committed to adopt or promote the Common Consent Form or any of the other UM HIE Tools. The State of Illinois, therefore, should not be considered one of the States that will take the actions described in Section 5.1 with respect to the Common Consent Form, the Consent Matrix, the Request for Information Form, or any other UM HIE Tool. The other UM HIE States have been advised that Illinois does not plan to participate in these activities and that it is likely that as Illinois law changes, the references to Illinois and its legal requirements in the Common Consent Form and the Consent Matrix will become out of date and should be deleted.






29

5.2 Proposed Pilot Project to Test the Use and Effectiveness of the UM HIE Tools

The UM HIE Consortium proposes a Phase II project to pilot the UM HIE Common

Consent form and tools. This project would involve exchanging the Common Consent

form between providers in bordering States’ medical trading areas using the NwHIN

Direct secure messaging protocol and specifications. Conducting one or more pilots in

the participating UM HIE States would provide valuable insight and lessons on how

effective the UM HIE tools are in a provider, clinic, or hospital setting and how easily the

use of the form and exchange via Direct Protocol can be integrated in to a clinician’s

workflow. Pilots would allow any needed improvements to the form and tools to be made

based on actual clinical use and feedback. The pilots will also help promote the use of

the form, develop buy-in to the concept of a Common Consent Form, and enable State

HIE organizations to more readily endorse the form and tools. These pilots have a

greater chance of being launched and resulting in a meaningful outcome if this Phase II

project proposal is approved by the ONC and financially supported through additional

State Health Policy Consortium funding. A more detailed description of the proposed

pilots is available in Appendix D.

5.3 Areas Where Additional State Health Policy Consortium Work Would be Helpful to UM HIE States

In order to provide concrete options to enable interstate HIE in the short term, the UM

HIE Consortium focused initially on use cases involving direct requests for patient health

information where:

• Provider A knows to direct a request to Provider B,

• The request is for treatment, payment or health care operation purposes, and

• Provider A has obtained consent from the patient for release of information up to

the full medical record, or no patient consent is required due to an emergency

situation.

The initial work of the UM HIE Consortium also focused primarily on mechanisms for HIE

that can be initiated independent of an HIO, such as through the use of NwHIN Direct

Protocols or other similar tools.

The UM HIE States recognize that although direct exchange between providers may

allow relatively easy short-term solution, ultimately patients and providers will benefit

from more streamlined and efficient ways to share electronic health information using

State HIE infrastructures that are currently being developed as part of ONC’s State

Health Information Exchange Cooperative Program. The UM HIE States have identified

several areas where additional assistance from the ONC and State Health Policy

Consortium work would inform and facilitate advancements for interstate HIE.

1) The UM HIE Consortium recommends that ONC promote discussions

among States to further explore more complex use cases, specifically:

a. Use cases focused on query transactions, such as instances where Provider A

knows patient is from another State, but does not know the specific provider

to request information from.






30

b. Use cases focused on instances where patient has provided consent for the

release of some, but not all of their medical records, such as when sensitive

health information is restricted.

2) The UM HIE Consortium recommends that ONC promote discussions

among States to further explore policy alignment and agreements to

enable interstate HIE through other mechanisms, and specifically:

a. Review the work flow process for HIO-HIO facilitated exchange to clarify

expectations of roles and responsibilities of the various parties to exchange

identified in Appendix A-5, page 4, the Electronic Consent Process Flow.

(Requesting Provider A, HIO A, HIO B, and Releasing Provider B). Specifically:

i. What are the expectations for the level of consent logged and/or

transmitted by providers in each State? What are their obligations for

participating/assisting in an audit by providers in other States?

ii. Which entity is responsible for holding an electronic copy of the actual

signed consent form?

iii. What is the agreed-upon format for the transmission of consent

information?

iv. At which point(s) are attestation of patient consent sufficient? Is policy

alignment desirable/possible to allow for attestation of consent in lieu of

the transmission of an actual consent document?

b. Establish reciprocal agreements between State-Designated Entities / State-

Certified HIOs for to further enable interstate HIE. Specifically, discussions

that address:

i. Establishing reciprocity to enable the pass-through of Meaningful Use

transactions in cross-border exchange, and specifically explores a model

for exchanges between State-level HIOs that avoids an additional layer of

cost for the simple pass-through of clinical Meaningful Use transactions.

ii. Sharing of statewide directory services, or other mechanisms and

strategies to assist in authentication of requesting providers engaged in

cross-border exchange.

iii. Establishing connections and policies for sharing information contained in

consent repositories to enable interstate HIE.

iv. Identifying best practices and roles of HIOs related to logging and storing

consent information, and expectations for participation/assistance with

audits by providers in the respective States.

3) The UM HIE Consortium recommends that ONC provide clear guidance to

States on whether State HIO participation in the Nationwide Health

Information Network will be sufficient to address the needs outlined

above, and the specific issues ONC believes warrant specific attention in

establishing agreements between States to enable interstate HIE.






31

5.4 Guidance for Future Implementation

The UM HIE States developed a process and tools that were flexible and iterative. The

participants made a conscious effort to periodically review their process and proposed

work products, particularly in the light of their environment, to remain feasible and

maximize the value of their solution. Complex issues of policy, law, mutual trust, and

real-life politics were all the subject of great discussion, in addition to the detailed work

on content and the tools themselves. Each State had to make a realistic assessment of

their ability to adopt and promote their solution within and across State lines. Issues

were tracked and decisions made about what could be addressed in the current

timeframe and what would be better addressed in a follow-on effort.

Overall, five States’ representatives came to consensus on a proposed Common Consent

Form and related documents that represent an advance in the body of thinking about

how States can exchange sensitive health data. Each participant intends to carry these

tools forward, and most have submitted proposed actions plans for achieving buy-in and

promoting adoption so that their systems will accommodate variability in State consent

to disclose laws appropriately.

We hope that the tools and processes described in this report provide a basis for or

inspire related work in other jurisdictions. Although a Common Consent Form is not

required for use in interstate exchange scenarios, such a product can reduce the burden

of time and the confusion that often accompany an interstate request. This product is

especially helpful in instances where consent regulations are particularly stringent or

complex in a regional setting. Appendix A provides a number of tools this consortium

used and recommends for States who wish to adopt a similar process, join the UM HIE

group in implementing the results of this work, or merely understand more clearly the

specific process that this group undertook. All of the tools in this appendix, as well as the

consent form documents listed in appendix B are freely available, and we encourage

States looking for a multistate solution to consent management issues to use them to

determine whether the end products satisfy their needs and the relevant State laws that

may be slowing exchange currently.

Appendix A:

Tools to Support State Consortia Addressing Barriers to HIE Exchange

A-1. Table on Interstate Agreement Mechanisms (Provided by Baker Donelson)

A-2. Environmental Scan Template

A-3. UM HIE Environmental Scan Summary

A-4. Interstate Use Cases

A-5. HIE Process Flows and Considerations

A-6. Table on Electronic Consent Options (Provided by HLN Consulting)

A-7. Inventory on Policy Alignment Options

Appendix A-1:

Table on Interstate Agreement Mechanisms (Provided by Baker Donelson)

1

W SC2 190930 v2

2918394‐000001 01/07/2011

Interstate Compact Model Law – Changes to State Law

Model/Negotiated Rule – State Action without Legislation

Policy Alignment – Data Use Agreements

Interstate Issue Pros Cons Pros Cons Pros Cons Pros Cons Consent GENERAL – standard consent policies and procedures agreed upon by all parties

Would establish rules governing which state’s consumer consent laws apply when health information is exchanged between states without need to change/harmonize individual state laws [this assumes CoL approach; can also use a substantive rule]; if substantive consent rules adopted, could pre‐empt existing state laws [rules of statutory construction apply]. Force of law in each jurisdiction with the flexibility of contract interpretation principles; uniform language in all jurisdictions; process provides opportunity for significant stakeholder input; potential for delegating implementation to state

Long process, could take two years or more to finalize. Would likely require Federal congressional approval; state constitutional questions of privacy rights may need to be addressed in some cases

Can use a process that incorporates stakeholder input; faster than compact process; force of law; no Congressional consent requirement; potential for uniform enforcement in all jurisdictions; state officials are given authority to act Would allow data to move most fluidly between states that adopted because of reduction in legal barriers; uniformity of enforcement

Significant, widespread stakeholder support required. Difficult to “repeal” more stringent laws, therefore states would likely have to harmonize around the most stringent requirements. Variations in laws will still be a problem; ability to include variations will make legislative process more political; may lack gravitas of compact proposal; stakeholder input can be very political; Contracts clause issues?; no

State action, can include governance and enforceability. A process similar to that used to develop a compact or like federal negotiated rulemaking provides opportunity for significant stakeholder input; potential for delegating implementation to state officials (according to specific guidance);

Differing, insufficient statutory authority for agency officials to undertake the necessary scope

Quick (compared to other options), Many resources available to build off of. May not require legislative action. Could be included as part of the standards adopted by state‐level HIE body. Allows flexibility while working out final, more permanent approach. Stepping stone to the more permanent approach. Can address

Does not identify a definitive governing body to oversee interstate exchange questions/issues. No defined conflict resolution mechanism. Serves as a work around, rather than a long‐term solution. Enforcement is an issue. Difficult to ignore more stringent laws, therefore agreements would likely have to harmonize around the most stringent requirements.

2

W SC2 190930 v2

2918394‐000001 01/07/2011




officials (according to specific guidance); uniform enforcement with the force of law; potential to create a multistate governance/enforcement entity; enforceable in both federal and state courts

mechanism to force state implementation (e.g., if statehouse changes) State courts can interpret identical statutory language differently.

process, content, enforcement, and some governance matters.

ELECTRONIC CONSENT MANAGEMENT

State is not prepared to manage consent electronically; not expected to support until late 2012.



STANDARD CONSENT FORM

Same issues as "GENERAL" above

Liability GENERAL – liability for an unauthorized disclosure or similar violation (a breach)as a result of reliance on requestor’s consent practice

Other state compacts have addressed liability in general – can address all liability concerns (civil, criminal, regulatory) if done well. Compact supersedes existing state law in conflict with it [rules of statutory construction apply].

Concerns about state laws that pre‐empt, which might necessitate federal legislative action or administrative rules to alleviate liability issues. Greater infringement on

Can use a process that incorporates stakeholder input; faster than compact process; force of law; no Congressional consent requirement;

How consistently the states adopt a model or uniform law will dictate the effectiveness. There is also the potential for uncertainty in the case of conflicting terms.

Same pros as for model law.

May be effective only with regard to regulatory liability; scope of regulatory authority across states may preclude uniform

Easiest for state to change should the State's desire to participate in aligning the policies or the termination of an agreement (also a "con").

(See "pro") Questionable how much quicker this will be than an interstate compact, as a liability section to an agreement term would still need negotiation. Cannot contract

3

W SC2 190930 v2

2918394‐000001 01/07/2011




Force of law in each jurisdiction with the flexibility of contract interpretation principles; uniform language in all jurisdictions; process provides opportunity for significant stakeholder input; potential for delegating implementation to state officials (according to specific guidance); uniform enforcement with the force of law; permits use of CoL mechanism, which may be more desirable on this issue (cf. consent); potential to create a multistate governance/enforcement entity; enforceable in both federal and state courts

“states’ rights” than other options; statutory process in each state is complex; education/public awareness requirements; likely need for Congressional consent; length of time to complete; implementation process in each state is complex

potential for uniform enforcement in all jurisdictions; state officials are given authority to act

Variations in laws will still be a problem; ability to include variations will make legislative process more political; may lack gravitas of compact proposal; stakeholder input can be very political; Contracts clause issues?; no mechanism to force state implementation (e.g., if statehouse changes) Other cons similar to compact

rulemaking Fastest process. Contracts can allocate liability among parties [but cannot alter any statutory liability]; can allow for indemnification

away legal liability; may have problems with enforcement of any requirements to meet out‐of‐state standards (designed to protect providers in more stringent states); no force of law in enforcement; no authority given to state agencies

Immunity (State) Would provide clear "rules" and federal approval would provide some certainty of acceptance.

May implicate state constitutional provisions. Potential disruption of state

Immunity may be expanded to the providers as well by change in the law, which would

Potentially a more expeditious solutions (compared to

Unlikely to result in progress for providers unless an agreement is also reached. Would

4

W SC2 190930 v2

2918394‐000001 01/07/2011




sovereign immunity under federal laws because of federal oversight and approval. Some case law notes that appearance in a federal court can mean a waiver of immunity.

enhance provider comfort and increase adoption.

other alternatives), although if an agreement is required, the negotiation would likely also be difficult.

likely not provide the same level of certainty as the interstate compact because of the federal "approval".

Insurance for consent liability (protection – market question)

Requiring insurance by contract is not unusual.

Potential disagreement re flexibility of amounts and carriers in negotiated language.

Indemnification ‐‐ agreement embodied in law or contract that one party will reimburse fines and damage awards against responding entity relying on requestor consent practice/process

Can authorize indemnification or limit its availability, as needed to balance market power between private parties

States may not be able to provide indemnity to one another.

Easiest and fastest way to address potential liability that could flow from a misstep that results in a technical breach

Similar cons to liability for breach, above

5

W SC2 190930 v2

2918394‐000001 01/07/2011

Issues informed by State HIE program

Technical Architecture/Standards

Policy/Legal

Education (Provider and Consumer)

Business and Technical Operations

Appendix A-2:

Environmental Scan Template

1

UM-HIE Consortium:

Environmental Scan Questionnaire

October 13, 2010

Introduction This questionnaire is designed to collect targeted information that will facilitate achieving certain of the project objectives discussed and refined at the September 29, 2010, Kick-Off Meeting. Those objectives are:

1. Developing a Common Consent Form (to be considered for use by the consortium states in situations and through mechanisms to be discussed and developed in later stages of the project);

2. Identifying exchange barriers other than consent (to further inform our efforts to understand and refine project scope);

3. Understanding existing sanctions for violations of patient consent requirements (to inform our efforts to identify methods for overcoming certain exchange barriers related to consent); and

4. Developing a common, high-level understanding of the current state of HIE development and implementation in each consortium state (to facilitate discussing and determining the kinds of exchanges [provider to provider; HIE to HIE] the project will address).

Information collected through the questionnaire will be used to develop a cross-state matrix that will serve as foundational information to facilitate the development of the Common Consent Form and other project deliverables.

UM-HIE Consortium Environmental Scan Questionnaire

2

State at Issue: Person Completing Questionnaire: Date:

Instructions: Please answer the following questions, providing citations to specific authority where applicable. Please attach copies of any cited authority.

Section 1: Patient Consent Requirements

1. Is explicit consent/authorization required to exchange patient health information of the types and for the purposes indicated in the chart below?

Please answer yes, no, or variable (where variable means patient consent requirements are more variable or where there are additional considerations for the user).

For those scenarios where you answer yes or variable, please attach a supplemental document providing additional detail and attach copies of authority relied upon.

Types of Data*

Types of UsesTreatment (Use)

Continuity of Care**

Public Health

Mandates Emergency Non-

Emergency General Medical Data (e.g., labs, radiology, surgery notes)

Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Drug & Alcohol Treatment Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Substance Abuse Treatment Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Mental Health:

Psychotherapy notes

Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Other mental health records Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Communicable Disease:

HIV/AIDS Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

STDs Other communicable diseases

Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable


3

Types of Data*

Types of UsesTreatment (Use)

Continuity of Care**

Public Health

Mandates Emergency Non-

Emergency Decedent Yes

No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Immunizations Yes No Variable

Yes No Variable

Yes No Variable

Yes No Variable

Please add other data types with specific consent requirements in your state.

* The information provided is not considered a definitive analysis of the subject discussed. It is acknowledged that fact situations involving authorization/consent questions can vary in each individual circumstance.

** By Continuity of Care we mean that all elements defined by the HITSP C32 (attached) are exchanged between parties. If your state law requires consent/authorization for any of the elements contained in this standard document, please identify in supplemental documentation the specific activities required.

2. Do your state laws, regulations, or other authorities define “emergency care” for purposes of consent/authorization requirements? Yes No

If yes, please describe:

3. Do your state laws, regulations, or other authorities define/establish any liability protection for a provider that relies in good faith on a third-party representation that patient health information is requested under emergency circumstances? Yes No


4. Does your state law establish specific requirements for consent to be effective? Yes No


5. Has your state developed a standard consent form(s)? Yes No

If yes, please attach.


4

Section 2: Exchange Barriers Other Than Consent

6. Other than consent, are you aware of legal requirements or other conditions that pose actual or potential barriers to your interstate electronic exchange of health information? Yes No


7. For any barrier or potential barrier identified above, are you aware of any potential solution for mitigating or overcoming the barrier? Yes No


Section 3: Sanctions for Patient Consent Requirement Violations

8. Do your state laws, regulations, or other authorities address the consequences for providers or others who violate requirements regarding patient consent to the release of health information? Yes No

If yes, please describe, providing among any other detail: the conduct subject to sanction; the range of available sanctions; and enforcement history.

Section 4: Current State of Intrastate HIE Initiatives

9. Which best describes the planned state HIE Governance Model as described in your state’s strategic and operational plan under the HIE cooperative agreement, including the role of state government?

Government-led electronic HIE: The government directly provides electronic HIE infrastructure and oversight of its use. ***

Electronic HIE public utility with strong government oversight: The public sector serves an oversight role and regulates private-sector provision of electronic HIE. ***

Private-sector–led electronic HIE with government collaboration: The government collaborates and advises as a stakeholder in provision of electronic HIE. ***

Other: Explain.


5

10. What is the current status of your state’s strategic and operational plans for health information organizations?

Approved

Submitted-Not Yet Approved

Not Submitted-In Development

11. Does your state plan for HIE envision one entity to provide HIE services and functions or multiple entities?

One entity. Name the entity, if possible:

Multiple entities. List entities, if known:

12. Which best describes your state’s proposed architecture?

Centralized architecture: The HIO collects and stores patient data in a centralized repository, data warehouse, or other database. The HIO has full control over the data and the ability to authenticate, authorize, and record transactions among participants. ***

Federated (de-centralized) architecture: A federated architecture uses interconnected independent databases that allow for data sharing and exchange, granting users access to the information only when needed. A distinguishing feature of a federated system is that the system employs multiple patient identification technologies, often called Global Patient Indices and Master Patient Indices. ***

Hybrid architecture: This is a hybrid of both centralized and federated architectures.

Multiple architectures: This results from a system with multiple entities with different architectures.

13. Does your state approach to health information exchange include establishing a state-operated health information organization to facilitate exchange? Yes No

If yes, does your state have written policies that specify how the health information organization will manage patient consent? (Please attach any available policies.)

If no, please describe any processes the state will use in developing such policies.

14. Does your state approach to health information exchange include building upon or utilizing private health information organizations to facilitate exchange? Yes No


6

15. Does your state have a regulatory framework to establish common requirements for private health information organizations? Yes No

If yes, do your state laws, regulations, or other authorities specify a health information organization’s duties/responsibilities regarding the management of patient consent? (If yes, please provide additional detail below.) Yes No

If yes, do your state laws, regulations, or other authorities address the consequences for health information organizations that violate requirements regarding patient consent to the release of health information? (If so, please provide additional detail below.) Yes No

If no, do your strategic and operational plans for health information exchange include any plans for establishing such a framework, or other mechanisms to establish common requirements for health information organizations in managing patient consent? (If so, please provide additional detail below.) Yes No

16. Are there currently any health information organizations that are operational in your state? Yes No

If yes, are the health information organizations operating on a federated model or a centralized model? Yes No

17. When do you anticipate your state having the HIE capability to support providers in achieving Stage 1 Meaningful Use requirements?

18. Describe below your state’s overall approach for HIE governance and ongoing strategic planning (e.g., What groups are engaged in what processes and/or decisions? How do you engage consumers?)

*** Source: Public Governance Models for a Sustainable Health Information Exchange Industry, Report to the State Alliance for E-Health (page 44)

Section 5: Other Issues

19. Are there other issues you believe the project team should address? Yes No

If yes, please describe.

Appendix A-3:

UM HIE Environmental Scan Summary

1

UM‐ HIE Consortium: Environmental Scan Summary

November 17, 2010

PATIENT CONSENT REQUIREMENTS 1. Whether a state requires explicit consent/authorization to exchange patient health information of

the types and for the purposes indicated Types of Data Emergency Non‐Emergency Continuity of Care Public Health

Mandates General Medical Data

ND: No WI: No SD: No MN: No IL: Variable IA: No

ND: No WI: No SD: No MN: Yes IL: Variable IA: No


ND: No WI: No SD: No MN: Variable IL: No IA: No

Drug & Alcohol Treatment

ND: No WI: No SD: Yes MN: No IL: No IA: Variable

ND: Yes WI: Yes SD: Yes MN: Yes IL: Yes Variable

ND: Yes WI: Yes SD: Yes MN: Yes IL: Yes Yes

ND: Yes WI: No SD: Yes MN: Variable IL: No IA: No

Substance Abuse Treatment

ND: No WI: No SD: Yes MN: No IL: No IA: No

ND: Yes WI: Yes SD: Yes MN: Yes IL: Yes IA: Yes

ND: Yes WI: Yes SD: Yes MN: Yes IL: Yes IA: Yes

ND: Yes WI: No SD: Yes MN: Variable IL: No IA: No

Psychotherapy notes

ND: No WI: Variable SD: No MN: Variable IL: Yes IA: Yes

ND: Yes WI: Variable SD: No MN: Variable IL: Yes IA: Yes

ND: Yes WI: Variable SD: left blank MN: Yes IL: Yes IA: Yes

ND: No WI: Variable SD: No MN: Variable IL: Yes Variable

Other mental health records

ND: No WI: No SD: Variable MN: Variable IL: No IA: No

ND: No WI: Yes SD: Variable MN: Variable IL: Yes IA: Variable

ND: No WI: Yes SD: Variable MN: Yes IL: Yes IA: Yes


HIV/AIDS ND: No WI: No SD: Yes MN: No IL: Variable IA: No

ND: No WI: No SD: Yes MN: Yes IL: Yes IA: Yes

ND: No WI: No SD: Yes MN: Yes IL: Yes IA: Yes

ND: No WI: No SD: left blank MN: Variable IL: No IA: No

2

STDS/Other communicable diseases

ND: No WI: No SD: No MN: No IL: Variable IA: No




Decedent ND: No WI: No SD: left blank MN: left blank IL: Variable IA: No

ND: No WI: Variable SD: No MN: Yes IL: Variable IA: No

ND: No WI: Variable SD: left blank MN: left blank IL: Variable IA: No


Immunizations ND: No WI: No SD: Variable MN: No IL: No IA: No


ND: No WI: No SD: Variable MN: Yes IL: No IA: No


Other (free type) ND: minors IL: See attachment A IA: See below

ND: minors ND: minors ND: minors

2. “Emergency care” defined for purposes of release consent/authorization requirements • Five states (IA, IL, ND, SD, and WI) do not explicitly define the term “emergency care” as used

specifically in the context of consent requirements for the release of heath information. o IA does define “emergency medical care” (outside the consent/release context) in its statute

governing the provision of emergency medical and trauma care. In that statute, “emergency medical care” is defined as the performance by trained emergency medical care providers of certain medical procedures (for example, administering IV fluids, performing cardiac defibrillation, and administering emergency medications).

o IL does have certain statutory provisions (addressing, for example, substance abuse treatment,

HIV and AIDS testing, and mental health treatment) that contain standards that may be relevant to developing a general definition of emergency for interstate use. (See, IL Attachment A at Section 1, Item 1)

o Without specifically defining the term emergency care, WI does provide for the release of

confidential treatment records without written consent “in a medical emergency” where obtaining consent is not possible because of the “individual’s condition or the nature of the medical emergency.” WI also permits the disclosure of a student’s health records in connection with an emergency “if necessary to protect the health or safety of any individual.”

3

• One state (MN) explicitly defines “emergency care” for purposes of release consent/authorization requirements. The Minnesota Health Records Act authorizes the release of health records in the case of a “medical emergency” which is defined as "medically necessary care which is immediately needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or prevent placing the physical or mental health of the patient in serious jeopardy.”

3. State law liability protection for a provider that relies in good faith on a third‐party representation

that patient health information is requested under emergency circumstances • None of the states have provisions in law providing explicit liability protection in the specific

circumstance where a provider releases information in good faith reliance on another party’s representation that the information is needed because of an emergency.

• In other contexts, IA state law provides some liability protection for the good‐faith release of

information (reporting on child and dependent adult abuse, reporting under the HIV statute). IA’s Disclosure of Mental Health and Psychological Information statute does not include this type of good‐faith safe‐harbor protection.

• WI provides a cause of action and penalties for violations related to both "patient health care

records" (general medical records) and "treatment records" (mental health, developmental disabilities and drug and alcohol treatment). WI statute creates a “good faith” exception to the inappropriate use/disclosure of patient health care records, stating “[a] custodian of records incurs no liability…for the release of records …while acting in good faith.”

• In MN, a person is liable to a patient if the person negligently or intentionally requests or releases a

health record in violation of the statute, or obtains a health record under false pretenses. If a provider releases a health record in reasonable and good‐faith reliance of a third‐party's false or negligent representation that the request is made because of a medical emergency, this provision could operate to place liability for the unauthorized release on the requester rather than on the releasing provider.

4. State law requirements for effective consent • Two states (ND and SD) do not have specific state law requirements for consent to be effective. • Four states (WI, MN, IL, and IA) do identify specific elements necessary for effective consent.

o WI identifies unique elements required for consent for the disclosure of defined types of health

information, including:

general medical records treatment records release of HIV results personal medical information in connection with an insurance transaction

For the release of most categories of information listed above, the consent must be written, dated, and signed. Other requirements applicable to some, but not all, categories include

4

(among others) the type of information to be disclosed, the types of health care providers making the disclosure, and the purpose of the disclosure.

o MN permits a provider to release health information if the provider holds (or has the

representation of another provider who holds) a consent that is written, dated, and signed.

o In IL, most statutes require consent to be written but do not require witnesses or other procedures. IL has adopted the federal consent requirements for the release of alcohol and substance abuse treatment information (see 42 CFR Part 2, Section 2.31). IL also establishes specific consent requirements for information governed by the Illinois Mental Health and Developmental Disabilities Act.

o In general, IA relies on basic requirements of state statutes and HIPAA to determine valid

consent. There are, however, specific statutory requirements specified for consent to the release of mental health information. Some of the requirements are that the consent be written, voluntary, and signed; and that it specify the nature of the information to be disclosed, who is authorized to disclose the information and for what purposes, and the rights of the subject of the information (such as the right to inspect the information and revoke the consent).

5. State‐specific standard consent forms • Four states (ND, WI, SD, and IL) do not have standard consent forms.

• Two states (IA and MN) have some form of standard consent form.

o IA has not developed a standard consent form but the Iowa State Bar Association has developed a standard consent form for use by attorneys that is generally compliant with all Iowa law.

o In MN, the Minnesota Department of Health developed the Minnesota Standard Consent Form

to Release Health Information. If completed properly, the form must be accepted by any health care organization, facility or professional identified in the form.

EXCHANGE BARRIERS OTHER THAN CONSENT 6. Legal requirements or other conditions (other than consent) that pose actual or potential

barriers to the interstate electronic exchange of health information • Three states (ND, SD, and IL) have not currently identified any specific barriers other than consent.

IL notes, however, that the identification of barriers other than consent is still a work‐in‐progress of the Legal Task Force in Illinois (an advisory group of health lawyers and others who are reviewing Illinois laws). The Legal Task Force may identify other barriers in the next few months. In addition, the requirements for consent may be imposed if the "Tiger Team" recommendations for "meaningful consent" are adopted because they seem to require consent for any transfer of information through a health information exchange even if not required by state law or HIPAA.

• Three states (WI, MN, and IA) have identified other barriers.

5

o WI identifies three general kinds of potential barriers, including a more detailed articulation of the issues around consent: State statutory language potentially constricting HIE ability to receive and release

information. A consortium of non‐profit health care entities (WISHIN) was named the State Designated Entity (SDE) to facilitate the electronic exchange of health information. Wisconsin’s release of information statutes contain language that could work as a barrier to exchange in the following ways:

• Limiting what information can be released to the SDE without patient consent. The

statutes permitting the release of general medical and treatment records without consent to a “health care provider” could act to prevent the SDE’s receipt of health information (without consent) because the SDE does not fall within the definition of “health care provider.”

• Limiting the ability of the SDE to release information it receives. Even if the SDE could receive the health information initially, the SDE is limited by statute to disclose the information only for the purpose for which the information was initially released.

State statues limiting the ability to obtain prospective consent to the release of health

information. WI identifies as an over‐arching concern related to consent requirements the issue of whether prospective consent can be effectively obtained. WI consent statutes requires that the consent:

• Identify to whom the disclosure can be made. Arguably this means that at the time

consent is obtained, the consent must list all the possible individuals and/or entities to whom the information may be disclosed in the future.

• Identify the type of information to be disclosed. Can the HIE properly identify,

prospectively, the type of information to be prospectively exchanged? Would the type of information exchanged change over time?

• Indicate the need or purpose for the disclosure. Presumably, the primary purpose

would be for treatment and continuity of care purposes. However, what if the HIE starts using the information for public health, quality assurance, research or other purposes?

Administrative Code language creating barriers to the electronic exchange of “treatment records.” The WI Administrative Code includes additional confidentiality provisions regarding "treatment records" protected under statute. As currently written, several of the provisions potentially create additional barriers to the electronic exchange of treatment records, as follows: • Re‐disclosure of treatment records prohibited unless re‐disclosure is “specifically

authorized by written consent of the subject individual…”

6

• Specific statements must be included whenever treatment records are disclosed. These requirements may be easily met when releasing paper records because the statements can be attached as a cover page. However, these provisions apply to all information that constitutes a “treatment record,” including individual data elements such as a laboratory value. Unless technologically blocked or filtered, individual pieces of protected health information may be electronically exchanged in Wisconsin. Attaching these statements to these elements of information is not practical and may not even be technologically possible. The end result is that providers who strictly apply state law may not allow the electronic exchange of protected information because they are unable to meet this requirement.

• Whenever information from a treatment records is disclosed, that information must be limited to include only the information necessary to fulfill the request. It does not seem feasible that with electronic exchange of treatment records, a computer system could be designed to effectively analyze and disclose only the amount of information necessary to fulfill the request.

o MN identifies a potential barrier to exchange in circumstances where two states have different laws related to the liability to which a provider might be exposed by receiving and relying on incomplete or inaccurate health record information from a provider in another state.

o IA identifies that a potential barrier might be a general misunderstanding regarding the scope of

the types of health information that might be subject to the most stringent privacy and security requirements (typically HIV/AIDS and mental health information). Because the law is not always clear on what rules apply to specific types of information, individuals concerned with the release of health information tend to apply the most stringent requirements, regardless of whether they apply in a particular situation. This tendency to be more restrictive in the release of information than technically warranted under the law can be enhanced because IA is predominantly rural with close‐knit communities and small community providers. There can be significant concerns about releasing information without specific patient consent because many patients, providers, and staff are inter‐related.

7. Potential solutions for mitigating or overcoming any barrier or potential barrier identified above

• WI states that mitigating the barriers it describes above would require WI legislative action to change statutory or administrative code language.

• IL states that barriers to interstate electronic HIE can be addressed through

o state legislation to amend the state statutes requiring consent to clarify ambiguous

provisions and, if possible, reduce the consent requirements; and

o federal legislation to provide greater pre‐emption and uniformity rather than the current variety of state laws.

• IA states that on‐going training as well as conformance of laws to a single articulable standard

would assist in overcoming these barriers.

7

SANCTIONS FOR PATIENT CONSENT REQUIREMENT VIOLATIONS 8. State laws, regulations, or other authorities addressing the consequences for providers or others

who violate requirements regarding patient consent to the release of health information • All six states have state laws, regulations, or other authorities that provide some sanctions for the

violation of requirements regarding the improper release of health information. • In ND, covered entities can impose employment sanctions such as dismissal or suspension for

violations. In addition, professional licensing boards (such as the Board of Medical Examiners and the Board of Pharmacy have authority to discipline license‐holders for improper disclosure of medical records.

• In WI, state statutes provide a cause of action and penalties for violations related to both "patient

health care records" under (general medical records) and "treatment records (mental health, developmental disabilities and drug and alcohol treatment). The language in the two statutes governing each type of record is very similar. For purposes of damages, both statutes distinguish between “negligent” and “willful” violations and range from $1,000 (negligent violation) to $25,000 (willful violation). Both statutes provide for civil penalties and prison sentences for violations that are willful or are done intentionally for pecuniary gain. Both statutes allow an individual to bring an action to cease violation of provisions under the chapter or to compel compliance with the provisions under each applicable chapter. Both statutes allow plaintiffs to recover damages plus costs and attorney fees. Finally, both statutes have provisions that allow the state or a political subdivision to terminate or suspend an employee without pay who violate the applicable provision.

• In SD, state law provides sanctions for the unauthorized release of patient health and immunization

information:

o By statute a health care provider can lose his or her license to practice, be enjoined, and/or face criminal sanctions.

o In addition, any licensing board having jurisdiction over a professional corporation may suspend

or revoke the certificate of registration of the corporation for unprofessional conduct by any shareholder or professional employee not promptly removed or discharged by the corporation. Unprofessional or dishonorable conduct includes willfully betraying a professional confidence.

o Any person who receives immunization data (under certain circumstances) and knowingly or intentionally discloses or fails to protect the confidentiality of the data is guilty of a Class 1 misdemeanor.

• MN state law provides sanctions for those who violate requirements regarding patient consent to the release of health information: o Violation of the Minnesota Health Records Act can result in monetary and other penalties and

may also be grounds for disciplinary action against a provider by a licensing agency or board.

8

o Any person who inappropriately requests a health record; forges a signature on or materially alters another person’s consent form without permission; or obtains a consent form or the health records of another under false pretenses, is liable to the patient for damages resulting from the unauthorized release, plus costs and attorneys fees.

o A patient is also entitled to receive compensatory damages plus costs and attorneys fee for the intentional or negligent violation of the Minnesota Health Records Act provisions governing record locator services.

o Enforcement action is complaint driven and centered at the licensing board level. Currently,

there is no system for tracking how persons might be pursuing private causes of action for compensatory and other damages.

• IL state law provides sanctions for those who violate requirements regarding patient consent to the release of health information: o Violation of most of state confidentiality statutes is a Class A misdemeanor punishable by up to

one year in jail and/or a fine of up to $2,500. o The Genetic Information Privacy Act provides for a private right of action for (1) negligent

violations ‐ the greater of actual damages or liquidated damages of $2,500 and (2) intentional violations, the greater of actual damages or $15,000.

o There is very little reported case law regarding violations of any of these statutes, and it is uncertain whether this is because there are few violations or a low level of prosecution and/or private action.

• IA state law provides sanctions for those who violate requirements regarding patient consent to the release of health information:

o Under the HIV/AIDS statute, a care provider who intentionally or recklessly makes an

unauthorized disclosure is guilty of an aggravated misdemeanor and subject to a civil penalty or $1000. The statute also authorizes the state attorney general to maintain a civil action to enforce its provisions.

o An employer agent, third‐party payor, or peer review organization that willfully uses or discloses

mental health information in violation of state stature is guilty of a serious misdemeanor and subject to $500 to $5000 per offense.

o Inappropriate disclosure may also be grounds for discipline by professional licensing boards.

o IA has had only a limited number of cases where sanctions have been sought for this type of issue, although cases have increased over the last two years. No HIPAA cases have been brought by the Iowa Attorney General.

9

CURRENT STATE OF INTRASTATE HIE INITIATIVES 9. HIE Governance Models as described in each state’s strategic and operational plan under the HIE

cooperative agreement • MN and SD plan for public utility electronic HIEs with strong government oversight.

• IA plans for a government‐led electronic HIE.

• WI plans for a private‐sector‐led electronic HIE with government collaboration.

• ND plans for a health information advisor committee comprised of four members designated by

statute and the remaining appointed by the governor.

• IL plans for an evolutionary model in which state government encourages and regulates private sector HIE initiatives, while developing a government‐led electronic HIE to eventually provide certain HIE services.

10. Status of state strategic and operational plans for health information organizations • All six states have submitted their plans and are awaiting approval. 11. Whether state plans for HIE envision one entity to provide HIE services and functions or multiple

entities

• Four states (ND, WI, SD, and IA) plan for one entity to provide HIE services. • Two states (MN and IL) plan for multiple entities providing HIE services.

12. Proposed architecture for state HIE • Four states (ND, WI, IL, and IA) propose a hybrid architecture.

• MN proposes multiple architectures.

• SD proposes a federated (de‐centralized) architecture. 13. Whether the approach to health information exchange includes establishing a state‐operated

health information organization to facilitate exchange.

• Three states (ND, IL, and IA) plan to establish a state‐operated organization to facilitate exchange. o Of the three, only IA currently has written policies regarding managing patient consent to the

release of health information. In IA, patients will have the opportunity to opt out of having their health information exchanged through the HIE.

10

• Three states (WI, SD, and MN) do not plan to establish a state‐operated organization to facilitate exchange.

14. Whether the approach to health information exchange includes building upon or utilizing private

health information organizations to facilitate exchange

• Five states (ND, WI, MN, IL, and IA) plan to use private health information organizations to facilitate exchange.

• SD does not plan to use private health information organizations to facilitate exchange.

15. Whether the state has a regulatory framework to establish common requirements for private

health information organizations, including managing patient consent. • Four states (ND, WI, IA, and SD) do not currently have a regulatory framework to establish common

requirements for private health information organizations.

o ND’s HIE Strategic and Operational Plan 11.7 (at p. 88) does include establishing common requirements for health information organizations in managing patient consent. (The term “consent” appears 28 times in the Plan.)

o WI’s plan for establishing the framework is addressed in the HIT Strategic and Operational plan

in the Legal and Policy Domain section. The presently reconstituted Legal and Policy Committee will begin implementation of the plan with regards to patient consent management and WI’s state‐level designated organization for facilitating exchange (WISHIN) will assume responsibility for taking over implementation of the legal and policy framework for intrastate and interstate exchange once its Board and committees are constituted and operational.

• Two states (MN and IL) do have a regulatory framework to establish common requirements for

private health information organizations, including managing patient consent and health information privacy and security, and the consequences for a HIO that violates requirements regarding patient consent.

o In MN, the Minnesota Health Records Act establishes requirements for use of a Record Locator

Service. A provider or an entity operating a Record Locator Service must provide a mechanism under which patients may exclude their identifying information and information about the location of their health records from a Record Locator Service.

In addition, this law requires a provider to obtain specific consent from the patient before accessing the Record Locator Service to find records on that patient, even for treatment purposes, except in the case of an emergency situation.

A patient is entitled to receive compensatory damages, plus costs and reasonable attorney fees, if a health information exchange maintaining a Record Locator Service, or an entity maintaining a Record Locator Service for a health information exchange, negligently or intentionally violates the provisions of the Minnesota Health Records Act.

11

o In IL, the HIE Authority is required to establish standards and requirements for the use of health information and participation in the IL HIE, including standards to ensure that the appropriate security and privacy protections apply to health information.

The IL HIE Authority is given the power by statute to suspend, limit, or terminate the right to participate in the IL HIE for non‐compliance with respect to applicable standards and laws.

16. Whether any health information organizations currently operate in the state • Four states (ND, SD, IL, and IA) do not currently have operating HIOs.

• Two states (WI and MN) do have operating HIOs.

o In WI, the HIOs operate under both federated and centralized models.

17. When states anticipate having the HIE capability to support providers in achieving Stage 1

Meaningful Use requirements

• Four states (ND, SD, MN, and IA) have target dates in 2011.

• Two states (WI and IL) have target dates in 2012. 18. The state’s overall approach for HIE governance and ongoing strategic planning, including

strategies/processes for identifying and engaging stakeholders • In ND, governance is handled by the Health Information Technology Advisory Committee which is a

committee of public and private stakeholders including the AARP. During its environmental scan, ND held public forums in several cities around the state to engage consumers. Additionally, the HIE Advisory Committee workgroups try to include as many stakeholders as possible.

• In May 2010, WI enacted the WIRED for Health Act which permits the State to either designate an existing non‐profit corporation or to create a corporation to serve as the permanent, public‐private state‐level HIE governance entity. The Department intends to designate WISHIN. The WISHIN Board will provide state‐level HIE oversight and be responsible for ongoing strategic planning. The WISHIN Board will assume the current WIRED for Health Board's governance responsibilities and will establish its own committees. Both the WISHIN Board and its committees will have broad stakeholder membership including consumer representatives.

• In SD, the SD Department of Health and the SD E‐Health Collaborative are engaged in the

development and planning for a governance structure. The E‐Health Collaborative has a consumer and a consumer organization that are members of the Collaborative.

• MN utilizes its existing e‐Health infrastructure for HIE governance and ongoing strategic planning.

The Minnesota e‐Health Advisory Committee makes policy and strategic recommendations to the Commissioner of Health and the Office of Health Information Technology. Those policy and strategic recommendations are often formed at the workgroup level. There are five workgroups for

12

2010‐2011: Health Information Exchange; Adoption and Meaningful Use; Standards and Interoperability; Privacy, Legal and Policy; and Communications and Outreach. Together, the workgroups and Advisory Committee advise the Department of Health on overall strategic planning for health information exchange. The Advisory Committee and Health Information Exchange workgroup are also involved in providing recommendations regarding oversight of health information exchange activities in Minnesota. The regulatory health information exchange activities are overseen by a review panel which makes recommendations to the Commissioner regarding health information exchange service providers. The make‐up of this review panel is defined in MN statute, but a link is made back to the Advisory Committee by having Advisory Committee members serve on the review panel.

• In IL, the HIE Authority will have a 14‐member Board of Directors, chosen with regard to a broad

geographic representation and a wide spectrum of health care stakeholders. (See IL Strategic & Operational Plan, pp. 29‐32, at http://www.hie.illinois.gov/assets/hiesop.pdf.)

• In IA, the first e‐Health Executive Committee and Advisory Council convened in January 2009. Under

the direction of the Executive Committee and Advisory Council, several volunteer workgroups were established to provide additional subject matter expertise for components of the planning process. The Executive Committee, Advisory Council, and workgroups are comprised of diverse stakeholders form public and private entities including health care providers, professional associations, government, payers, educators, researchers, and consumers. To support the work of these groups the Iowa Department of Public Health assembled an internal e‐Heath team, now formalized as the Office of Health IT. The Office provides leadership to harmonize all committee, council, workgroup, and staff activities necessary to support Iowa e‐Health planning and implementation.

IA is pursuing legislation in 2011 to formalize the governance structure. If proposed legislation is enacted, Iowa e‐Health will be governed by a board of directors, rather than the e‐Health executive committee. The board will represent stakeholders such as provider organizations and associations, providers, payers, purchasers, government, business, and consumers. The board will set direction, goals, and policies for Iowa e‐health and provide oversight of the business and technical operation of the HIE and services. The Iowa Department of Public Health’s Office of Health IT will support day‐to‐day operations for Iowa e‐health.

OTHER ISSUES

19. Other issues the project team should address

• Four states (ND, WI, SD, and MN) have not identified other issues to be addressed.

• Two states (IL and IA) have identified other issues the project team should address.

o IL believes the project team should address

the Tiger Team recommendations regarding "meaningful consent" for use in HIE; and

13

the ways in which the need to exchange information will evolve with changes under health

care reform, including the increasing use of bundled payments and the "medical home" model, which may involve providing information for purposes of quality assessment as well as payment.

IA believes the project team should keep in mind issues relating to the education of

providers, consumer and others in relationship to the utilization of any HIE, as consumer and provider understanding will be critical to the acceptance of any HIE and planning for these issues should therefore be an integral part of the process.

Appendix A-4:

Interstate Use Cases

UPPER MIDWEST HEALTH INFORMATION EXCHANGE (UM HIE) STATE HEALTH POLICY CONSORTIUM INTERSTATE HEALTH INFORMATION EXCHANGE USE CASES AND CONSENT/PRIVACY ISSUES

DRAFT for Discussion Purposes (04-13-2011)

04-13-2011

Purpose The purpose of this document is to describe Use Cases where health information would likely be exchanged across state borders using either Direct Exchange facilitated by a Health Information Service Provider (HISP) between known providers or Facilitated Exchange through a Health Information Exchange Organization (HIO), and to describe the current state of consent management and other privacy issues that need to be considered to advance the exchange of patient health records with providers in other states for treatment, payment or health care operations purposes. Scope In scope: Situations where a patient is not physically present at the disclosing provider’s office and the request for the disclosure of health records is made at the point of service in another state. Out of scope: Situations where a patient has signed a consent for treatment/release of records that allows information to be sent prospectively to any provider (prospective consent) for a defined period of time. Assumptions: 1. The request for health records of a patient is being made only for treatment, payment or health care operations related to the patient, and the requesting provider has made the determination

that it is clinically and legally appropriate to send a request for information for such purposes. 2. Records being requested under the Use Case can include information up to the full record of health information on a patient, including records pertaining to sensitive services such as

mental health records, substance abuse treatment program services or any other services requiring enhanced or more detailed patient consent or authorization under state or federal law. 3. Not all states in the UM HIE Consortium can include sensitive health information in a patient’s health records. 4. The consent required under the Use Cases can be accomplished using a signed paper consent form in the current phase of the project. However, it is expected that an electronic process to

capture, store and transmit the required consent will be developed in future stages of the UM HIE Consortium Project Work. 5. This document provides a starting point for discussion of Use Cases. Additional use cases may be added over time as needed. Definitions of Key Terms 1. Emergency: a situation where information about a patient is needed for the purpose of treating a condition which poses an immediate threat to the health of an individual and which

requires immediate medical intervention-[derived from 42 CFR Part 2]

1



04-13-2011

Note: Is there consensus that this is the definition that will apply if a state does not have a statute defining the term “Emergency” in its state laws? Is it reasonable to assume that to the extent that a state does not have a definition of emergency, an UM HIE Consortium state will seek to clarify in its state laws or elsewhere in its State HIE Plan that the UM HIE consensus definition of “Emergency” applies? North Dakota recommended language: For the purpose of interstate Health Information Exchange (HIE), when federal law or applicable law of another state permits the disclosure of Protected Health Information (PHI) only in an emergency, the term “emergency” shall mean….

2. More Restrictive (MR) State: state in which patient consent must be obtained before releasing records, even for treatment, payment and health care operations purposes 3. Less Restrictive (LR) State: state in which no consent is required to release patient records for treatment, payment or health care operations, but could have consent requirements for the

release of special records, such as those related to mental health treatment, sensitive services, or substance abuse treatment programs. 4. Attestation of Patient Consent: Requestor acknowledges patient has signed a written consent for the release of his/her health care records 5. Attestation of Emergent Situation: Requestor acknowledges that request is being submitted as a result of an emergent situation and information is needed for the purpose of treating a

condition which poses an immediate threat to the health of an individual and which requires immediate medical intervention. 6. Electronic Signatures: TBD

2



04-13--2011

USE CASE 1: HISP Facilitated Direct Exchange – Transfer from (LR) State

Method of Exchange: Direct Exchange facilitated by a Health Information Service Provider (HISP) between two known health care providers or entities Requestor (State A): Health care provider or entity located in State A with more restrictive (MR) consent requirements Disclosing Provider (State B): Health care provider or entity located in State B with less restrictive (LR) consent requirements Purpose of request for records: for treatment, payment or health care operations as defined under HIPAA

Use Case Scenario Interstate Consent/Privacy Issues Considerations and Key Issues

for Policy Alignment A Non-Emergency Treatment.

Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in State A(e.g. doctor’s office, health care treatment facility such as hospital or outpatient services). The patient identifies the provider in State B who has his/her prior health records and Requestor sends a request directly to the Disclosing Provider in State B for copies of the patient’s health records for treatment purposes.

Disclosing Provider must confirm the identity of the patient, authentication of the Requestor’s identity, and that the health records are being requested for treatment, payment or health care operations purposes. Once confirmed, the Disclosing Provider sends patient’s health records in secure transmission to Requestor.

B Non-Emergency Treatment with Sensitive Health Record Information Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in State A. The patient identifies the provider in State B who has his/her health records, including records related to sensitive services. Requestor sends a request directly to the Disclosing Provider in State B for copies of all of the patient’s health records for treatment purposes.

Requestor must obtain written consent of patient to obtain health records related to sensitive services in accordance with the consent laws of LR state, if applicable.

Disclosing Provider must confirm the identity of the patient, authentication of the Requestor’s identity, and that the health records are being requested for treatment, payment or health care operations purposes. Once confirmed and appropriate consent for disclosure of sensitive services health records has been obtained, if applicable, Disclosing Provider can send patient records in secure transmission to Requestor.

3


04-13-2011

C Emergency Treatment.

Adult person (‘patient”) who resides in State A is seen by a health care provider in State B (e.g. hospital emergency room) for emergency treatment. The patient is unable to give consent to access prior health records (e.g. patient is unconscious or medical needs require immediate attention.) ER provider/Requestor has information pointing to the existence of health records pertaining to the patient at a certain provider located in State A.

Requestor confirms the identity of the patient, authentication of the Requestor, and that the health records are being requested for treatment, payment or health care operations purposes. Once confirmed, the Disclosing Provider sends patient’s health records in secure transmission to Requestor.

4



04-13-2011

USE CASE 2: HISP Facilitated Direct Exchange – Transfer from (MR) State

Method of Exchange: Direct Exchange facilitated by a Health Information Service Provider (HISP) between two known health care providers or entities Requestor (State A): Health care provider or entity located in State A with Less Restrictive (LR) consent requirements Disclosing Provider (State B): Health care provider or entity located in State B with More Restrictive (MR) consent requirements Purpose of request for records: for treatment, payment or health care operations as defined under HIPAA

Use Case Scenario Interstate Consent/Privacy Issues Considerations and Key Issues for Possible Policy Alignment A Non-Emergency Treatment.

Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in another State A (e.g. doctor’s office, health care treatment facility such as hospital or outpatient services). The patient identifies the provider in another state who has his/her prior health records and Requestor sends a request directly to the Disclosing Provider in the other state for copies of the patient’s health records for treatment purposes.

Requestor must obtain written consent of patient to obtain health records from Disclosing Provider in accordance with the consent laws in MR state.

Once Disclosing Provider authenticates Requestor’s identity and confirms patient has given consent for the disclosure of the patient’s health records, Disclosing Provider can send patient records in secure transmission to Requestor.

B Non-Emergency Treatment with Sensitive Health Record Information Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in another state. The patient identifies the provider in another state who has his/her health records, including records related to sensitive services. The Requestor sends a request directly to the Releasing Provider in the other state for copies of all of the patient’s health records for treatment purposes.

Requestor must obtain written consent of patient to obtain health records from Disclosing Provider in accordance with the consent laws in MR state. Requestor must include written consent for disclosure of special records related to sensitive services as required by federal or MR state law.

Once Disclosing Provider authenticates Requestor’s identity and confirms patient has given consent for the disclosure of the patient’s health records, Disclosing Provider can send patient records in secure transmission to Requestor.

5


04-13-2011

C Emergency Treatment. Adult person (‘patient”) who resides in State A is seen by a health care provider in State B (e.g. hospital emergency room) for emergency treatment. The patient is unable to give consent to access prior health records (e.g. patient is unconscious or medical needs require immediate attention.) ER provider has information pointing to the existence of health records pertaining to the patient at a certain provider located in State A.

Requestor/ER provider must confirm criteria for “emergency” are met and document this fact in its EHR system. Requestorsends request to Disclosing Provider indicating emergency exists and requests access to patient’s health records.

Disclosing Provider confirms the identity of the patient and authentication of Requestor. Based on the attestation of Requestor/ER provider that emergency exists, Disclosing Provider sends patient records in secure transmission to Requestor.

6


DRAFT for Discussion Purposes

03-25-2011

USE CASE 3: Facilitated Exchange – Transfer from (LR) State

Method of Exchange: Facilitated Exchange through HIOs in each of the states where Requestor and Disclosing Provider are located Requestor (State A): Health care provider or entity located in State A with more restrictive (MR) consent requirements Disclosing Provider (State B): Health care provider or entity located in State B with less restrictive (LR) consent requirements Purpose of request for records: for treatment, payment and health care operations as defined under HIPAA

Use Case Scenario Interstate Consent/Privacy Issues Considerations and Key Issues for

Possible Policy Alignment A Non-Emergency Treatment.

Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in another State A (e.g. doctor’s office, health care treatment facility such as hospital or outpatient services). The patient does not recall where his/her health records are located in another known State B. Requestor submits query to its (MR) State A HIO to find location of the patient’s records in State B. State A’s HIO connects with HIO in State B (LR) to locate patient’s records. If records are found, Disclosing Provider transfers patient records via its State B HIO that in turn exchanges the records with the State A HIO in the Requestor’s state, and ultimately to the Requestor.

Requestor must follow the requirements in (LR) State A for submitting a query to or accessing a record locator service (RLS) of State A’s HIO, and/or before requesting patient’s health records from a provider identified through the RLS.

Once Disclosing Provider confirms State A’s HIO has authenticated the identity of the Requestor and confirms patient has given appropriate consent, Disclosing Provider sends patient’s records in secure transmission to Requestor via HIO to HIO exchange.

B Non-Emergency Treatment with Sensitive Health Record Information Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in another State A. The patient identifies the provider in another known State B who has his/her health records, including records related to sensitive services. Requestor submits query to its (MR) State A HIO to find the location of the patient’s records in State B. State A’s HIO connects with the HIO in State B (LR) to locate patient’s records. If records are

Requestor submits query for patient records to HIO in State A. State A HIO contacts HIO in State B, which identifies what consent requirements must be met to submit a query to or access a record locator service (RLS) of the HIO in State B and ultimately obtain the patient’s health records from the Disclosing Provider. The two HIOs work collaboratively to determine if patient has opted-out of RLS, identify consent requirements for sensitive services records, if applicable, and ensure the necessary patient consent is obtained.

Once Disclosing Provider confirms its State B HIO has authenticated the Requestor and ensures patient has given appropriate consent, if

7


03-25-2011

found, Disclosing Provider transfers the patient records via its State B HIO that in turn exchanges the records with the State A HIO, and ultimately to the Requestor.

applicable, Disclosing Provider sends patient’s records in secure transmission to Requestor via HIO to HIO exchange.

C Emergency Treatment. Adult person (‘patient”) who resides in State A is seen by a health care provider in State B (e.g. hospital emergency room) for emergency treatment. The patient is unable to give consent to access prior health records (e.g. patient is unconscious or medical needs require immediate attention.) ER provider/Requestor does not know where patient’s health records are located, but can identify patient’s state of residency by patient’s driver’s license. Requestor sends a query through its State A HIO, which connects with the HIO in State B to find location of health records.

Requestor confirms criteria for “emergency” are met and documents this fact in its EHR system. ER provider sends query to HIO in State B to find location of patient’s health records.

If patient has not opted-out of the RLS in State B, HIO in State B authenticates the identity of the Requestor through HIO in State A and confirms the existence of emergency situation (if required) and forwards request for patient’s records to the Disclosing Provider.

Disclosing Provider relies on State B HIO’s authentication of Requestor and sends patient records in secure transmission to Requestor via HIO to HIO exchange.

8



04-13-2011

USE CASE 4: Facilitated Exchange – Transfer from (MR) State

Method of Exchange: Facilitated Exchange through HIOs in each of the states where Requestor and Disclosing Provider are located Requestor (State A): Health care provider or entity located in State A with less restrictive (LR) consent requirements Disclosing Provider (State B): Health care provider or entity located in State B with more restrictive (MR) consent requirements Purpose of request for records: for treatment, payment and health care operations as defined under HIPAA

Use Case Scenario Interstate Consent/Privacy Issues Considerations and Key Issues for Possible Policy Alignment A Non-Emergency Treatment.

Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in State A (e.g. doctor’s office, health care treatment facility such as hospital or outpatient services). The patient does not recall where his/her health records are located in another known State B. Requestor submits query to its (LR) State A HIO to find the location of the patient’s records in State B. State A’s HIO connects with the HIO in (MR) State B to locate patient’s records. If records are found, Disclosing Provider transfers the patient records via its State B HIO that in turn exchanges the records with the State A HIO in the Requestor’s state, and ultimately to the Requestor.

Requestor submits query for patient records to HIO in State A. HIO in State A authenticates the Requestor and transmits electronic request and appropriate consent information to HIO in State B. HIO in State A (1) identifies requirements that must be met to submit a query to or access a record locator service (RLS) of the HIO in State B and obtain the patient’s health records from the Disclosing Provider, and (2) works with Requestor to ensure appropriate consents are transmitted with the query. Agreements between the HIO in State A and HIO in State B enable the organizations to rely on the authentication of Requestor and Disclosing Provider within their respective states.

HIO in State B receives request from HIO in State A and queries the statewide record locator service of State B. When records have been located, HIO in State B requests information from providers in State B with appropriate consent information. Disclosing Provider relies on its (MR) State B HIO to authenticate the identity of the Requestor and to ensure patient has given appropriate consent., Disclosing Provider sends patient’s records in secure transmission to Requestor via HIO to HIO exchange.

9


04-13-2011

B Non-Emergency Treatment with Sensitive Health Record Information Adult person (“patient”) seeks non-emergency medical treatment from a health care provider in State A. The patient does not recall where his/her records are located in another known State B, including records related to sensitive services. Requestor submits query to its (LR) State A HIO to find the location of the patient’s records in State B. State A’s HIO connects with the HIO in (MR) State B to locate patient’s records. If records are found, Disclosing Provider transfers the patient records via its (MR) State B HIO that in turn exchanges the records with the (LR) State A HIO, and ultimately to the Requestor.

Requestor submits query for patient records to HIO in State A. State A HIO A (1) identifies requirements that must be met to submit a query to or access an RLS of the HIO in State B. and obtain the patient’s health records from the Disclosing Provider and (2) works with Requestor to ensure appropriate consents are transmitted with the query. Agreements between the HIO A and HIO B enable the organizations to rely on the authentication of Requestor and Disclosing Provider within their respective states.

HIO in State B receives request from HIO in State A and queries the statewide record locator service of State B. When records have been located, HIO in State B requests information from providers in State B with appropriate consent information. Disclosing Provider relies on its State B HIO to authenticate the identity of the Requestor and to ensure patient has given appropriate consent. Disclosing Provider sends patient’s records in secure transmission to Requestor via HIO to HIO exchange.

10


04-13-2011

C Emergency Treatment. Adult person (“patient”) is seen by a health care provider in State A (e.g. hospital emergency room) for emergency treatment. The patient is unable to give consent to access prior health records (e.g. patient is unconscious or medical needs require immediate attention.) ER Provider/Requestor does not know where patient’s health records are located, but can identify patient’s state of residency by patient’s driver’s license, State B . Requestor sends a query to its state (LR) HIO in State A to locate patient records in the patient’s home (MR) state. If records are found, Disclosing Provider transfers records via its State B HIO that in turn exchanges the records with the State A Hio and ultimately to the Requestor.

Requestor confirms criteria for “emergency” are met and documents this fact in its EHR system. Requestor sends query for patient records to HIO in State A with an Attestation of emergency situation. HIO in State A contacts HIO in State B, with an Attestation of emergency situation.

HIO in State B receives request from HIO in State A and queries the statewide RLS in State B. When records have been located, HIO in State B requests information from providers in State B with indication that an Attestation of emergent situation has been received. Disclosing Provider relies on its State B HIO to authenticate the identity of the Requestor. Disclosing Provider sends patient’s records in secure transmission to Requestor via HIO to HIO exchange.

11

Appendix A-5:

HIE Process Flows and Considerations

Example of Electronic Consent Process Flow1 – Direct Exchange (non-emergency)

Draft for Discussion Only – Updated March 25, 2011

State Line

Patient Visit

--------------------------------

HIO B

Provider A

1. Obtains and stores consent toobtain records from known provider

2. Requests Information fromknown provider with form orattestation of consent consistent withrequirements of state (B)

3. Receives records from Provider Bfor use in treating patient

4. Maintains all consent records necessary for auditing purposes

Provider B

1. Receives request for patient records with form or attestation ofconsent consistent with state requirements

2. Authenticates/verifies legitimacy of Provider A

3. Prepares file for transmission utilizing accepted national standards

4. Employs NHIN Direct protocols totransmit files to Provider A

HIO A

Return

Request

1

Draft for Discussion Only – Updated 3/25/11

Figure 1. Example of Electronic Consent Process Flow – Direct Exchange Assumptions

1. Consent must be obtained for treatment and data exchange. 2. Common consent form or other valid form is used in the transaction. 3. Records being requested can include information up to the full medical record 4. Direct protocols can be used for both request and return.

What additional assumptions should be included?

Considerations for Workgroup 1: Consent Form

1. At each step, what is the expectation for the level of consent logged and/or transmitted? (Format of Consent: 1. Attestation of Consent, 2. Actual Consent)

a. consent to locate records b. consent for treatment c. consent for release of all records d. consent for release of sensitive information

1. Mental Health 2. HIV/AIDS 3. Substance Abuse Treatment 4. Minors 5. Other

2. Does this vary based upon whether State B is a “Less Restrictive” or “More Restrictive” state?

3. At which points is attestation of patient consent sufficient? 4. What information must be included in an attestation of consent? 5. Does the current UM-HIE Draft consent form address all types of consent? 6. if not, what information is necessary for a-d in 1 above

What additional considerations should be included?

Considerations for Workgroup 2: Electronic Consent

1. What is the agreed upon format for the transmission of consent information: a. electronic PDF b. electronic standard

2. How should an electronic copy of the signed consent form be stored? 3. How would attestation of consent be represented in an electronic exchange (e.g.

“checkbox” in standard message)

2


4. How do Direct Protocols support consent management? a. directories b. authentication

What additional considerations should be included? Considerations for Workgroup 3: Policy Alignment

1. What is the expectation for the level of consent logged and/or transmitted by Provider A? Does this vary based upon whether State B is a “Less Restrictive” or “More Restrictive” state?

2. Who is responsible for holding electronic copy of actual signed consent form? 3. For which of the UM HIE states is an attestation of patient consent sufficient? 4. What are the audit requirements for the requesting and releasing providers? 5. How long must records be maintained for auditing purposes? 6. In what way might HIOs and/or statewide shared services support Direct

Exchange and consent management? (e.g. HISP services, use of provider directories to access routing information and authenticate/verify legitimacy of requesting providers)

7. To what extent do agreements need to be established between the states for the use of statewide shared services identified above?

8. To what extent do current or planned RFP’s for directory development include specifications for consent forms or links to forms? (e.g. UM-HIE form or form of disclosing provider available through shared directory in State B)


3

Example of Electronic Consent Process Flow2 – Facilitated Exchange (non-emergency)

Draft for Discussion Only – Updated March 25, 2011

State Line

Patient Visit HIO A

------------------------

HIO B

Provider A1. Obtains and stores consent

a. To query RLSb. To obtain records

2. Requests Information from HIESP with form or attestation of consentand indication of patient records in known state (B)

3. Receives full results from HIO A for use in treating patient

4. Maintains all consent records necessary for auditing purposes

HIO A1. Authenticates Provider A2. Verifies and logs appropriate

consent(s)3. Transmits request for

Information from other state HIO(s) with necessary consent information

4. Receives aggregated responsefrom HIO B, combines with intrastate query results (if applicable)

5. Transmits full results to Provider A

HIO B1. Authenticates HIO A2. Verifies and logs appropriate

consent(s)3. Engages statewide RLS

to locate records4. Transmits request for

located records from participating entities statewide(directly or through other HIO(s)with appropriate consent(s)

5. Receives and aggregates responses from State B providers

6. Transmits aggregated results to HIO A

State B Providers1. Receive request for located

records 2. Receives & logs appropriate

Consent to release records3. EHR generates CCD, PDF or

other agreed upon format4. Transmits information to HIO B

Return

Request

4


Figure 2. Example of Electronic Consent Process Flow – Facilitated Exchange Assumptions

1. Consent must be obtained for treatment, data query and exchange. 2. Common consent form or other valid form is used in the transaction. 3. Records being requested can include information up to the full medical record. 4. Process of exchange is electronically automated through the EHR (not “manual”). 5. Participating HIOs are IHE-compliant.

What additional assumptions should be included? Considerations for Workgroup 1: Consent Form

1. At each step, what is the expectation for the level of consent logged and/or transmitted?

a. consent to locate records b. consent for treatment c. consent for release of all records d. consent for release of sensitive information

1. Mental Health 2. HIV/AIDS 3. Substance Abuse Treatment 4. Minors 5. Other

2. Does this vary based upon whether State B is a “Less Restrictive” or “More Restrictive” state?

3. At which points is attestation of patient consent sufficient? What additional considerations should be included? Considerations for Workgroup 2: Electronic Consent

1. At each step, what is the expectation for the level of consent logged and/or transmitted? Does this vary based upon whether State B is “Less Restrictive” or “More Restrictive” state?

2. What is the agreed upon format for the transmission of consent information: e. electronic PDF, f. electronic standard

3. What is the agreed format for the transmission of attestation of consent? 4. Which pieces will be contained within the work flow of the HIE portal?

5


5. What are the technical requirements for the state designated entities/state certified HIOs with respect to:

1. authentication 2. aggregation 3. audit log content 4. other

6. To what extent will the HIOs’ participation as an NHIN Connect node address these questions, and what will need to be specifically addressed in agreements between HIOs in the UM HIE states?

What additional considerations should be included? Considerations for Workgroup 3: Policy Alignment

1. At each step, what is the expectation for the level of consent logged and/or transmitted? Does this vary based upon whether State B is a “Less Restrictive” or “More Restrictive” state?

2. What is the agreed upon format for the transmission of consent information: electronic PDF, electronic standard (based on recommendations from Electronic Consent Workgroup)

3. Who is responsible for holding electronic copy of actual signed consent form? 4. At which point of exchange is attestation of patient consent sufficient? 5. What are the audit requirements at each level:

a. Reg Provider, b. HIO-A, c. HIO-B, d. Disclosing Provider

6. How long must records of consent be maintained for auditing purposes? What are the federal requirements? Are there any state specific requirements?

7. What is the agreement between the state designated entities/state certified HIOs with respect to:

a. charges for services b. authentication requirements c. where aggregation occurs d. what is contained in audit logs e. what the role of each entity is in the audit process f. other

8. To what extent will the HIOs’ participation as an NHIN Connect node address these questions, and what will need to be specifically addressed in agreements between HIOs in the UM HIE states? (Can we have someone with ONC help us evaluate this?)


6

Appendix A-6:

Table on Electronic Consent Options (Provided by HLN Consulting)

UM HIE Electronic Consent Options

HLN Consulting, LLC 5/4/2011

Options for Storing Electronic Consent

Option Strengths Challenges

1 Representation of Consent

transmitted by requesting

clinician in body of Direct

message (or similar tool)

♦ Relative simple to implement

♦ Requires little central infrastructure to

implement

♦ Requires use of Direct or a similar tool

♦ Only valid in states where representation

of consent is legal

2 Representation of Consent

entered by requesting clinician

in a web-based application and

accessed by sending clinician

♦ Allows broad-based access to consent

data by authorized users in any state

♦ Users only require a web browser

♦ Application must be created and

maintained

♦ Users must be authorized and maintained

♦ Only valid in states where representation

of consent is legal

3 Image of patient-signed consent

document transmitted by

requesting clinician attached to a

Direct message (or similar tool)

♦ Relative simple to implement

♦ Requires little central infrastructure to

implement

♦ Enables transmission when full consent

document is required

♦ Requires use of Direct or a similar tool

♦ Clinician must be capable of scanning

consent documents

4 Consent entered with digitally-

captured patient signature into a

web-based application by

requesting clinician and accessed

by sending clinician

♦ Allows broad-based access to consent

data by authorized users in any state

♦ Users only require a web browser

♦ Enables access when full consent

document is required

♦ Application must be created

♦ Users must be authorized and maintained

♦ Clinical sites must have signature capture

pads

5 Consent document submitted

and stored in an IHE-compliant

document repository

♦ Standards-based way to represent consent

♦ More limited use of IHE which can

expand into broader use once participants

can support it

♦ Since use of IHE transactions is limited,

alternate access to consent document

repository could be provided

♦ Requires limited IHE transaction support

to store and retrieve consent documents

♦ May requires additional work to develop

alternate access methods to document

repository

1

UM HIE Electronic Consent Options

HLN Consulting, LLC 5/4/2011

Option Strengths Challenges

6 Consent received by requesting

clinician within an IHE-

compliant transaction using

BPPC as a result of query

Consent attached to clinical

documents deposited in a

document repository

♦ Standards-based way to represent

consent

♦ Allows for consent to be managed within

the work flow of the clinical site through

integration with the EHR-S

♦ Allows for more granular consent rules

to be implemented by articulating

explicit rules or attaching consent to

specific clinical documents

♦ Allows clinicians to register patient

consent documents with an HIE

♦ Can support many styles of consent

documentation, including image of a

consent document (or just a signature)

deposited in the document repository

♦ Requires support for IHE XDS

transactions both within the EHR-S and

the HIE

♦ Requires support for BPPC both within

the EHR-S and HIE

♦ Enforcement based on trust between HIE

participants and agreement on policies

♦ Granular consent rules difficult to

implement and manage

2

Appendix A-7:

Inventory on Policy Alignment Options

1

Upper Midwest Health Information Exchange State Health Policy Consortium

Inventory of Mechanisms of Policy Alignment Tools into State HIE Infrastructure Minnesota Illinois North Dakota South Dakota Wisconsin Conclusions Market Levers

• Incorporate language in contracts between state-certified HIE Service Providers and their users/participating entities to allow for representation of consent if the requesting provider uses the common consent form and the provider is authenticated through another state’s authorized Health Information Exchange Organization.

• Require MN state-certified HIE Service Providers to include in contracts with their users/participating entities a provision to make the common consent form available to all providers (both in MN and outside of MN) and to agree to accept the common consent form if properly executed.

• Including in state RFPs (e.g. for entities that would like to provide shared services in MN, etc.) the expectation that entities will incorporate the use of the common consent form.

• Incorporate the use of

Assuming the Authority were to approve OHIT’s recommendation in favor of adoption in IL of the common consent form, all the “levers” identified (market, formal policy, and informal policy) would be considered for implementation of the State’s policy. IL OHIT would not propose for the consideration of the General Assembly or the Authority any proposed PHI policy, including the adoption of the common consent form, unless it can be demonstrated that it results in (1) improved patient care, (2) improved population health, (3) reduced healthcare costs, without (1) requiring significant resources from the State, (2) imposing upon IL health care providers and payors (including state of IL) significant workflow burdens or costs or (3) undermining the quantity or quality of

The first three market levers listed: contract processes; RFP processes; and Medicaid payment contracts—have the potential to be implemented in ND. (ND does not have a high penetration of highly restricted managed-care programs.) ND is in the process of reviewing proposals in response to an RFP for an HIE vendor—and could consider requiring the vendor to install a standard electronic consent form.

Contract processes—SD could draft contract language requiring a vendor to implement a common consent form if one is available. RFP Processes—could be used in the future as this process has been completed in SD. Payment Contracts—the implementation of a common consent form could be a condition of payment as part of the contract.

Managed Care Operations—SD will not be working with managed care organizations.

The potential exists to have the following organizations require the use of the common consent form via contracts: • With the WI Employee

Trust Funds (ETF) in requiring the consent form to be used by the health plans that it contracts with to provide health insurance for state employees.

• With WI DHS and our Managed Care Organizations that provide the Family Care benefit.

• The WI DHS , as a condition of participation could require Medicaid providers and HMOs to use/accept the consent form for members they treat

• WI DHS could endorse the use of the form, assign it a DHS form number and put it on its website.

SD and WI have completed the RFP process. ND is in the process of reviewing proposals in response to an RPF—may be a possibility to consider the consent form requirement. MN could include language in contracts with HIE Service providers, users, participating entities to use the common consent form. MN, ND, and WI can include language with Medicaid contracts to require the use of the common consent form.

2

Minnesota Illinois North Dakota South Dakota Wisconsin Conclusions the common consent form into the Medicaid payment contracts.

PHI data made available for HIE.”

Formal Policy Levers

Legislation. MN believes some options might exist in the next several years to pursue amendments in state statutes that could help facilitate interstate HIE. Some options could include: • Legislative proposal(s)

to expand the definition of the term “provider” under the MN Health Records Act to include providers in another state if they are authenticated through the applicable state health information organization in that state, allowing MN providers to rely on representations by those out-of-state providers that they have obtained patient consent.

• Proposed amendments to the MN HIE Oversight Law to require applicants for an HIE Service Provider Certificate of Authority to make available and educate providers about the UM HIE Consortium policy alignment tools, such as the common consent form.

• Rulemaking. Although the Administrative

See previous response. At this time, ND has not considered proposed legislation or administrative rules to require or authorize acceptance of a common consent form. Conceptually, however, the ND HIE advisory committee has authority to adopt rules requiring use of the common consent form, and our goal is to have a common consent form for both intrastate and interstate transmission of electronic health information.

Current legislation, S.B. 2037, is expected to be enacted. This bill will provide immunity from liability for providers that rely in good faith on health information transmitted through the ND HIE.

Legislation—at the present, is not an option in SD. Proposed Rulemaking Authority.—the SD Department of Health may be able to promulgate administrative rules relative to the development and use of a Common Consent Form. Licensure Requirements—the SD Department of Health may be able to promulgate administrative rules as part of licensure requirements relative to the development and use of a Common Consent Form. Liability Protections—SD may be able to provide a level of liability protection through the certificate authority that is being created in the HIE.

Our future legislative process includes plans to change our laws to mirror HIPAA to permit disclosures of protected health information for the purposes of treatment, payment or health care operations.

Legislation. All states do not have any current legislative plans to mandate the requirement of the consent form for use within the state. Proposed Rulemaking Authority. Some limited rule-making opportunities may exist in requiring the use of the consent form (MN and SD). Licensure Requirements. SD may be able to implement requirement of using consent forms as part of licensure requirements. Liability Protections. Current legislation in ND will provide immunity of liability for providers who rely in good faith on health information transmitted through the ND HIE. SD may be able to provide a level of protection through the certificate of authority (HIE).

3

Minnesota Illinois North Dakota South Dakota Wisconsin Conclusions Procedures Act in MN can require significant time and resources to pursue changes via rulemaking, some opportunity exists to implement policy alignment agreements and tools through rulemaking initiatives.

Informal Policy Levers

Explore options to implement the policy alignment tools developed by the UM HIE Consortium through interstate agreements, including establishing the requirements for use of the common consent form. Explore whether the MN Commissioner of Health could use the process under the MN Health Records Act to establish the UM HIE Common Consent form as a standard consent form in MN, similar to that used to create and implement use of the MN Standard Consent Form in 2008.

The MN e-Health Advisory Committee and its workgroups would provide opportunities for MN to discuss how stakeholders could incorporate use of the UM HIE Consortium tools into their operations, such as making the common

See previous response. ND is open to becoming a party to and "Interstate Agreement" establishing requirements for use of the common consent form and other tools developed by the UM HIE Consortium.

Potential agreements among major health care systems will arise naturally as providers and health systems within geographic health care trading areas will come to identify the value of using common consent forms. The ND hospital association could encourage its members to use and accept a common consent form, and that the ND medical Association will encourage physicians to use a common consent form. ND has not considered the use of standard contract language

SD may agree to sign a MOA/MOU that would have a provision for the use of a common consent form. Agreements among major health care systems are not an option for SD. SD may be willing to work with provider/medical associations to endorse education and encourage SD providers to use and accept the common consent form.

WI could make requests to the WI Hospital Association and the WI Medical Society to endorse the use of this form.

Some states are open to the option of an interstate agreement (MN, ND and SD). States that could encourage their hospital and physician associations to endorse the use of the common consent form (ND, SD, and WI)

4

Minnesota Illinois North Dakota South Dakota Wisconsin Conclusions consent form available to their entities/providers and educating providers on how use of the form could facilitate interstate HIE.

regarding consent forms for HIO-to-HIO exchanges of electronic health information across borders of the UM HIE states. But the ND HIE could float that proposal to interested stakeholders.

Other None at this time, but ND is in the early stages of developing its HIE and applicable consent policies

WI could make the request and obtain support from the HIPAA Collaborative of Wisconsin (COW) to endorse and post the form on their website.

Appendix B:

UM HIE Tools for Enabling Interstate HIE

B-1. Upper Midwest Consent Matrix

B-2. Upper Midwest Common Consent Form

B-3. Upper Midwest Health Information Request Form

Appendix B-1:

Upper Midwest Consent Matrix


Upper Midwest Consent Matrix Page 1 of 2 Revised: September 30, 2011

1

Purpose. The Upper Midwest Consent Matrix can be used in connection with the Upper Midwest Common Consent Form for Full Disclosure and the Upper Midwest Common Consent Form to enable the exchange of consent and the disclosure of health information among the Upper Midwest States (Illinois, Minnesota, North Dakota, South Dakota, and Wisconsin) for treatment, payment, and health care operation purposes. Instructions. To request disclosure of health information from an Upper Midwest State:

(1) use the Upper Midwest Consent Matrix to determine if the disclosure triggers a requirement for patient consent; �

(2) request that the patient complete the Upper Midwest Common Consent Form (if consent is required); �

(3) complete the Upper Midwest Health Information Request Form; and �

(4) use the Direct Project Health Information Exchange Protocol to transmit the Health Information Request Form, along with the patient‐completed Upper Midwest Common Consent Form (if needed), by attaching images of the documents and sending them the to disclosing provider via direct message.


Upper Midwest Consent Matrix Page 2 of 2 Revised: September 30, 2011

2

When is Patient Consent Required to Disclose Health Information for Treatment, Payment or Health Care Operations?

For Disclosure in a Non‐Emergency:

*Does not include “psychotherapy notes” as defined in HIPAA at 45 CFR 164.501 which are subject to additional authorization.

For Disclosure in an Emergency**:

*Does not include “psychotherapy notes” as defined in HIPAA at 45 CFR 164.501 which are subject to additional authorization. ** Note that the definition of emergency varies by state statute.

Consent is Required for Disclosure of

General Health

Information

Consent is Required for Disclosure

from Hospitals

Consent is Required for Disclosure of Health Information on Sensitive Conditions

Alcohol and

Substance Abuse

Treatment

Mental Health*

HIV/ AIDS

STDs and other Communicable

Diseases

Develop‐mental Disability

Genetic Testing

Sexual Assault and Abuse

Child Abuse & Neglect

Abuse of an Adult with a

Disability

Illinois

Minnesota

North Dakota

South Dakota

Wisconsin

Consent is Required for Disclosure of

General Health

Information

Consent is Required for Disclosure

from Hospitals

Consent is Required for Disclosure of Health Information on Sensitive Conditions

Alcohol and

Substance Abuse

Treatment

Mental Health*

HIV/ AIDS

STDs and other Communicable

Diseases

Develop‐mental Disability

Genetic Testing

Sexual Assault and Abuse

Child Abuse & Neglect

Abuse of an Adult with a

Disability

Illinois

Minnesota

North Dakota

South Dakota

Wisconsin

Appendix B-2:

Upper Midwest Common Consent Form

Upper Midwest Common Consent Form For Full Disclosure of Health Information for Treatment, Payment & Health Care Operations

Upper Midwest Common Consent Form Page 1 of 3 Revised: September 30, 2011

1

Patient (name and information of person whose health information is being disclosed):

Name (First Middle Last): ____________________________________________________________________________ Date of Birth (mm/dd/yyyy): _________/__________/_____________________ Address:__________________________________________City:____________________State:______Zip:___________

You may use this form to allow your healthcare providers and payors to disclose, access and use your health information from services provided in Illinois, Minnesota, North Dakota, South Dakota or Wisconsin. Your choice on whether to sign this form will not affect your ability to get health care or health insurance coverage and cannot be used as the basis for denial of health services. By signing this form, I voluntarily authorize and give my permission and allow disclosure: OF WHAT: ANY OF MY HEALTH INFORMATION from services provided in Illinois, Minnesota, North Dakota, South Dakota, or Wisconsin, including any information about sensitive conditions (if any) [See page 3 for details]; Disclosure of health information located in Illinois will not occur unless consent is granted with respect to all applicable information below. ___ If you do not have any health information for services provided in Illinois, check here.

FROM WHOM: ALL information sources [See page 3 for details]

***PLEASE READ THE ENTIRE FORM, ALL PAGES, BEFORE SIGNING BELOW***

Note Regarding Disclosure of Health Information Located in Illinois: To authorize the disclosure of health information for services provided in Illinois, you must initial all of the categories of information listed below to the extent that they apply to you: __ HIV/AIDS related health information and/or records __ Information about sexually transmitted diseases __ Drug/alcohol diagnosis, treatment, and /or referral information __ Genetic testing information and/or records __ Information about sexual assault/abuse __ Information about child abuse and neglect __ Abuse of an adult with a disability Failure to initial all of the categories that apply will render this consent invalid for disclosure of any of your health information for services provided in Illinois. If you want only a portion of your health information shared, you need to use a patient consent form for limited disclosure of health information, instead of this form. If you want to disclose mental health or developmental disability information and/or records (including psychotherapy notes as defined in the federal HIPAA Privacy Rule at 45 CFR 164.501), an additional authorization is required. ___ If your health services were provided Illinois but none of it falls within any of the categories above, check here and all of your health services provided in Illinois will be disclosed.



2

TO WHOM: Specific person(s) or organization(s) permitted to receive my information (must be a health care provider): Person/Organization Name:___________________________________________Phone: (_____)__________________ Address:___________________________________________________________Fax: (_____)_____________________ PURPOSE: To provide me with health care treatment and related services, to facilitate payment for services, and to support health care operations. EFFECTIVE PERIOD: This consent/permission form will remain in effect until the day I withdraw my permission or until the date specified here___________, whichever occurs first. WITHDRAWING MY PERMISSION: I can withdraw my permission at any time by giving written notice to the person or organization named above in “To Whom,” subject to the details of “Withdrawal” on page 3.

In addition: I authorize the use of a copy (including electronic copy) of this form for the disclosure of the information described above. I understand that there are some circumstances in which this information may be redisclosed to other persons and that the recipient of redisclosed information may be controlled by different laws. [See page 3 for details]. I understand this authorization is voluntary and I am under no obligation to sign this form and no organization may condition treatment, payment, enrollment, or eligibility for benefits on signing this form. I understand that refusing to sign this form does not stop disclosure of my health information that is otherwise permitted by law without my specific authorization, consent, or permission. I have read all pages of this form including the explanation that follows and agree to the disclosures.

X______________________________________________ ___________________________________ Signature of Patient or Patient’s Legal Representative Date Signed (mm/dd/yyyy) X______________________________________________ Print Name of Legal Representative (if applicable) Check one to describe the relationship of Legal Representative to Patient (if applicable):

Parent of minor Guardian Other personal representative (specify): ______________________________________________

NOTE: Under some state laws, minors must consent to the release of certain information. The law of the state from which the information is to be released determines whether a minor must consent to the release of the information. This form is invalid if modified. You are entitled to get a copy of this form after you sign it. You may have a right to inspect, and upon paying any applicable fees, obtain a copy of the disclosed records.



3

Explanation of Form

Laws and regulations require that an individual give written consent for the disclosure of some sources of identifiable health information. Also some laws require specific consent for the disclosure of information about certain conditions. “Of What” includes: ANY OF YOUR HEALTH INFORMATION, including:

1. All records and other information regarding your health history, treatment, hospitalization, tests, and outpatient care that is held by or on behalf of providers and/or payors located in Illinois, Minnesota, North Dakota, South Dakota, or Wisconsin. This information may relate to sensitive health conditions (if any), including but not limited to:

a. Drug, alcohol, or substance abuse b. Psychological, psychiatric or other mental impairment(s) or developmental disabilities (excludes “psychotherapy notes” as defined in

HIPAA at 45 CFR 164.501 in any state, and any Illinois mental health or developmental disability information and/or records, all of which require additional authorization)

c. Pregnancy, birth control and family planning d. Records which may indicate the presence of a communicable disease or noncommunicable disease; and tests for or records of

HIV/AIDS or sexually transmitted diseases or tuberculosis e. Genetic (inherited) diseases or tests f. Sexual assault/abuse g. Child abuse and/or neglect h. Domestic abuse of an adult with a disability 2. Information created before or after the date of this form.

“From Whom” includes: All information sources including (if applicable), but not limited to, health care providers, plans and payors (including hospitals, clinics, labs, pharmacies, physicians, psychologists, alcohol and drug treatment programs, health care insurers, Medicare and Medicaid, etc.). “To Whom”: For those health care providers listed in the “To Whom” section, your permission also includes physicians, other health care providers (such as nurses) and medical staff who are involved in your medical care at that organization’s facility or that person’s office, and health care providers who are covering or on call for the specified person or organization, and staff members or agents (such as business associates or qualified services organizations) who carry out activities and purpose(s) permitted by this form for that organization or person that you specified. Disclosure may be of health information in paper or oral form or may be through electronic interchange. “To Whom” may also include health plans that provide payment for services rendered such as a commercial insurance, Medicare or Medicaid. “Purpose”: Your signature on this form does NOT allow health insurers to have access to your health information for the purpose of deciding to give you health insurance. You can make that choice in a separate form that health insurers use. For purposes of this consent, “treatment”, “payment,” and “health care operations” have the same meaning as defined under the federal HIPAA Privacy Rule at 45 CFR 164.501. “Health care operations” are broadly viewed or defined as activities necessary for the business operations of a health care entity but do not include marketing or fundraising activities. “Withdrawal”: You have the right to revoke this consent and withdraw your permission in writing regarding any future uses. Your revocation is effective when it is received by the entity that requested or disclosed your information. Your revocation or the expiration of the consent period is not effective with respect to any use or disclosure of your health information before the revocation is received or the expiration occurs. You should understand that organizations that had your permission to access your health information may copy or include your information in their own records. These organizations, in many circumstances, are not required to return any information that they were provided nor are they required to remove it from their own records. Revocation or expiration of this consent may not apply to information provided to an insurer if state law provides the insurer the right to contest a claim under your policy. “Re‐disclosure of Information”: Any health information about you may be re‐disclosed to others only to the extent permitted by state and federal laws and regulations. You understand that once your information is disclosed, it may be subject to lawful re‐disclosure, in accordance with applicable state and federal law, and in some cases, may no longer be protected by federal or state privacy law. [Note to recipient(s) of the information disclosed under this Consent: This information may have been disclosed to you from records protected by federal confidentiality (e.g. 42 CFR Part 2) or state privacy rules (e.g. Wisconsin Statute 51.30). If so, these rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted. Limitations of this Form: If you want your health information shared for purposes other than for treatment, payment or health care operations, or if you want only a portion of your health information shared, you need to use a patient authorization form for limited disclosure of health information, instead of this form. Also, this form cannot be used for disclosure of psychotherapy notes in any state or any Illinois mental health or developmental disability information and/or records, any of which require an additional authorization instead of this form. This form does not obligate your health care provider or other person/organization listed in the “From Whom” or “To Whom” section to seek out the information you specified in the “Of What” section from other sources. Also, this form does not change current obligations and rules about who pays for copies of records.

Appendix B-3:

Upper Midwest Health Information Request Form

Upper Midwest Health Information Request Form

Upper Midwest Health Information Request Form Page 1 of 1 Revised: September 20, 2011

1

Purpose. The Upper Midwest Health Information Request Form can be used in connection with the Upper Midwest Consent Matrix and Upper Midwest Common Consent Form for Full Disclosure to enable the exchange of consent and the disclosure of health information among the Upper Midwest States (Illinois, Minnesota, North Dakota, South Dakota, and Wisconsin) for treatment, payment, and health care operation purposes. Instructions. To request disclosure of health information from an Upper Midwest State:

(1) use the Upper Midwest Consent Matrix to determine if the disclosure triggers a requirement for patient consent; (2) request that the patient complete the Upper Midwest Common Consent Form (if consent is required); (3) complete the Health Information Request Form below; and (4) use the Direct Project Health Information Exchange Protocol (Direct Protocol) to transmit the Health Information Request Form, along with the patient‐completed Upper Midwest Common Consent Form (if needed), by attaching images of the documents and sending them the to disclosing provider via direct message.

Requesting Provider Information Person/Organization Name: ______________________________________ Phone: (_____)________________ Address: ______________________________________________________Fax: (______)__________________ Email Address: ______________________@___________________________

Patient Information Name (First Middle Last): ______________________________________________________________________ Gender: M F Date of Birth (mm/dd/yyyy): __________/__________/__________________ Address: ___________________________________________________ City: _______________________State: ____________Zip:___________

Patient Information Requested Continuity of Care Document (CCD), consisting of the following kinds of information:

Problems Procedures Family history Social history Payers Advance directives Alerts Medications

Immunizations Medical equipment Vital signs Functional stats Results Encounters Plan of care

Other: ___________________________________________________________

Appendix C:

State Action Plans

C-1. Minnesota State Action Plan

C-2. North Dakota State Action Plan

C-3. South Dakota State Action Plan

C-4. Wisconsin State Action Plan

Appendix C-1:

Minnesota State Action Plan

1

Minnesota State Action Plan Upper Midwest HIE State Health Policy Consortium – September 2011

Background on Stakeholder Review In 2010 the Office of the National Coordinator for Health IT (ONC) created the State Health Policy Consortium (SHPC) project to support multistate initiatives that would develop solutions to policy challenges specific to interstate health information exchange. The Upper Midwest Health Information Exchange (UM HIE) project was the first multistate consortium to apply and receive approval from RTI International, the research institute that manages the overall SHPC project for ONC. Participating states include Minnesota (serving as lead state), Illinois, North Dakota, South Dakota, and Wisconsin.

The UM HIE project team worked to develop tools designed to be concrete solutions to challenges affecting the exchange of health information for treatment purposes among the UM HIE states. For a description of the project work, see the UM HIE State Health Policy Consortium Project Report Summary attached. The Minnesota Department of Health (MDH) representatives on the UM HIE project actively sought Minnesota stakeholder input by engaging the Minnesota e‐Health Initiative. The Minnesota e‐Health Advisory Committee established the Privacy, Legal and Policy (PLP) Workgroup as the primary source for Minnesota stakeholder input on the project, and both groups received regular reports from MDH on its progress.

During 2010 and 2011, the PLP Workgroup actively participated in reviewing and providing feedback on the UM HIE project’s process and work product, including its (1) analysis of each state’s current and proposed health information exchange infrastructure and the laws affecting health information exchange (Environmental Scan); (2) proposed options for harmonizing state‐to‐state policy and legal conflicts affecting exchange (Implementation Levers); and (3) tools to facilitate interstate exchange, including the Common Consent Form, Consent Matrix, and Request for Health Information Form (UM HIE Tools).

Minnesota Plans for Implementation Each of the UM HIE states was charged with developing an action plan for encouraging the use of the UM HIE Tools in the state (State Action Plan). The UM HIE project team articulated possible Implementation Levers that each state could consider adopting as part of its State Action Plan. The types of Implementation Levers proposed include (1) legislative or regulatory policy levers (i.e., agency policy action, legislation, or rulemaking); (2) market levers (i.e., vendor contract terms mandating the use of the UM Tools); and (3) informal levers (i.e., provider education and outreach).

State Action Plan Prerequisite: MN e‐Health Advisory Committee Endorsement of Stakeholder Recommendations. Minnesota UM HIE project participants actively engaged and consulted with the Minnesota e‐Health Advisory Committee’s PLP Workgroup at each phase of the UM HIE project work. Members of the PLP Workgroup provided thoughtful comments about how the Common Consent Form would need to be amended to meet Minnesota privacy and consent laws especially with respect to the duration of the consent. Assuming that the Common Consent Form would be amended to address its concerns, the PLP Workgroup reached a consensus that the Common Consent Form, the Consent Matrix and the Information Request Form would be valuable resources that would both (1) advance the electronic exchange of patient health information with providers across state borders to enhance patient treatment and care; and (2) continue to safeguard the right of patients to control access to their patient health information. In July 2011, the PLP Workgroup agreed upon the following recommendations to be submitted to the e‐Health Advisory Committee for its review and endorsement:

2

1. Minnesota Department of Health Endorsement of UM HIE Tools. The PLP Workgroup recommends that the Minnesota e‐Health Advisory Committee make a recommendation to the Commissioner of Health to take action to endorse and encourage the acceptance and use of the Common Consent Form as a trusted form for obtaining the consent of a patient who is willing to share his or her health information with another provider for treatment, payment or health care operations, including providers located in other states that agree to use the UM HIE Common Consent Form.

2. Minnesota Department of Health Outreach to Promote Use of UM HIE Tools. The PLP Workgroup further recommends that the Minnesota e‐Health Advisory Committee encourage MDH to identify ways to educate and promote the acceptance and use of the UM HIE Tools as a trusted means of obtaining patient consent among Minnesota providers, health payers and other entities engaged in facilitating the exchange of health information for treatment, payment and health care operations across state borders, upon endorsement of the participating UM HIE Consortium states.

The recommendations of the PLP Workgroup will be presented to and considered by the Minnesota e‐Health Advisory Committee at its meeting on September 26, 2011.

Minnesota State Action Plan Upon Minnesota e‐Health Advisory Committee endorsement of the PLP Workgroup Recommendations, MDH will undertake the following State Action Plan for implementation of the UM HIE Tools:

I. Legislative and Regulatory Policy Levers In the short term at least, implementation strategies that rely on formal legislative or rulemaking action are not likely to be adopted. Minnesota will therefore employ alternative levers to encourage the use of the UM HIE Tools that rely on less formal implementation mechanisms.

A. Endorsement by the Minnesota Department of Health MDH will develop a letter or declaration of endorsement to be issued by the Commissioner that encourages providers and other entities holding or facilitating the exchange of patient health information in Minnesota to accept and use the UM HIE Common Consent Form as a valid form of patient consent for the release of the patient’s health information to another provider. To the extent the Commissioner approves such letter, MDH plans to widely distribute and publish the letter of endorsement, both inside Minnesota and to the State Government HIT Coordinators in the UM HIE states.

B. State Certified Health Information Exchange Service Providers In Minnesota, entities that facilitate the exchange of clinical meaningful use transactions between providers must obtain a Certificate of Authority to operate as a Health Information Exchange (HIE) Service Provider from the Minnesota Department of Health pursuant to the Minnesota Health Information Exchange (HIE) Oversight Law (Minnesota Statutes §§62J.498‐62J.4982.) Applicants for Certificates of Authority must submit detailed information regarding their operations in Minnesota, including how they will ensure compliance with the consent requirements for the disclosure of a patient’s health information under the Minnesota Health Records Act (Minnesota Statutes §§144.291‐144.298.) MDH will use the certification process to inform applicants about the UM HIE Tools and seek information from them regarding how they will use the UM HIE Tools in providing HIE Services in Minnesota, as well as how they will make the tools and educational materials broadly available for providers for interstate exchange of patient health information.

3

C. Consideration of Future Legislative or Regulatory Action At the current time, the political and economic climate in Minnesota is not likely to support legislative or rulemaking initiatives for formal action to require the acceptance and use of the UM HIE Tools. In time, with Minnesota’s participation in the Phase II Pilot Project and demonstrated use and functionality of the UM HIE Tools, it is possible that the utility of the UM HIE Tools will be recognized and formal adoption of the UM HIE Common Consent Form could be obtained through the legislative or regulatory process. MDH will regularly evaluate the need, value and opportunities for legislative or regulatory action to encourage or require the use of the UM HIE Tools in Minnesota.

II. Market Levers Minnesota agencies will explore a range of market lever approaches on how its purchasing power could be leveraged to encourage or mandate the use of the UM HIE Tools both immediately and in the long‐term. The primary approaches will occur through state procurement activities for Minnesota’s health information exchange infrastructure and through the state’s purchasing power as a payer and provider of care.

A. Minnesota Health Information Exchange Procurement Activities Through current procurement activities for the development of Minnesota’s shared services technical infrastructure and incentives to providers and State‐Certified HIE Service Providers for their expansion of health information exchange, Minnesota plans to require:

1. Entities that receive funding from the state, both HIE Service Providers and health care providers, to utilize the UM HIE Tools such as the Common Consent Form.

2. Entities that receive funding from the state for shared services to incorporate the recommendations of the Electronic Transmission Workgroup for: (a) short‐term adoption of the Direct Protocol for transmission of consent forms; and (2) long‐term development of an IHE‐compliant document repository for managing consent.

3. Entities that receive funding from the state for shared services to participate in and offer interstate agreements with border and high frequency trading states to establish: (a) mutual expectations for use of the UM HIE Tools; and (b) appropriate linkages to common shared services, such as provider directories.

Minnesota’s procurement activities will be announced in the fall of 2011, and it is anticipated that contracts will be in place by early 2012.

B. State Government in Purchasing of Health Care Services In addition, MDH is utilizing its State Government Health Information Exchange Steering Committee (Committee) to evaluate additional state purchasing levers. The Committee is comprised of representatives from four state agencies, including the Departments of:

• Health • Human Services (State Medicaid Agency) • Corrections • Minnesota Management and Budget (State Employee Benefits)

During the fall of 2011 the Committee will discuss the feasibility and methods for utilizing its state purchasing power to:

1. Require the use of UM HIE Tools through state contracts with health care providers;

4

2. Require the use of UM HIE Tools in Medicaid managed care or disease management programs through state contracts with health plans; and

3. Require the use of UM HIE Tools through state employee health benefit contracts to entities providing services under these contracts.

III. Informal Policy Levers MDH will use informal policy levers by building on current partnerships as well as establishing new relationships to engage with providers on the effectiveness of using the UM HIE Tools as they seek to improve workflow processes when conducting interstate exchange.

A. Collaborations and Communications MDH will collaborate with the Minnesota e‐Health Initiative, its Advisory Committee and workgroups, Minnesota’s HIT Regional Extension Center, and the various provider and consumer associations in Minnesota on efforts to broadly educate providers, patients and consumers on the benefits of electronic Health Records (EHRs) and how the practice of interstate exchange could help them. MDH identified the following activities for 2011‐2012 to advance interstate exchange:

1. Use biannual briefings with the Communications & Outreach Workgroup to share UM HIE Tools and ask for immediate and short‐term follow‐up including some dialogue with provider association representatives on how they would promote it with their own audiences.

2. Seek to develop educational materials and resources on health information exchange as part of Minnesota’s Health Information Exchange Cooperative Agreement, including the use of UM HIE Tools, for providers and consumers. The Cooperative Agreement provides the opportunity to contract with a marketing firm to develop strategies and a broad range of materials with appropriate focused feedback on how to effectively use them.

3. Work with sections within MDH (e.g. Health Care Homes, MCYSHN, Asthma) to identify specialty areas that could benefit from UM HIE Tools to improved consent management and health information exchange policies and best practices, and develop plans for engaging those groups for learning about and using UM HIE Tools.

4. Continue to update the Minnesota e‐Health website to make available the UM HIE Tools and incorporate Minnesota stakeholders’ suggestions and other related information to aid in the promotion of their use.

B. Pilot Projects MDH will participate in Pilot Projects with North Dakota, South Dakota, and Wisconsin to evaluate the effectiveness of the UM HIE Common Consent Form and other Tools for improving the exchange of health information across state borders. MDH will identify providers in Minnesota willing to participate in a Pilot Project and will help establish the process for the Pilot Projects. MDH will use the Minnesota e‐Health Summit and other forums to share preliminary learnings from the Pilot Projects with providers and consumers.

Moving Forward The Minnesota Department of Health will continue to consult the Minnesota e‐Health Advisory Committee and Minnesota’s State Government HIE Steering Committee to inform the State’s approach to making the UM HIE Tools available to providers and educating them on their use; and to provide ongoing guidance on future legislative or regulatory policy levers, market levers, and informal policy levers to ensure providers’ acceptance and use of the UM HIE Tools.

Appendix C-2:

North Dakota State Action Plan

1

North Dakota State Action Plan Upper Midwest HIE State Health Policy Consortium – September 2011

North Dakota Plans for Implementation State Action Plan Prerequisite: ND Health Information Technology Advisory Committee Endorsement of Stakeholder Recommendations.

North Dakota UM HIE Project Participants: Participants engaged with the review of the UM HIE Tools include the HITAC and the HITAC legal and policy workgroup. Comments were provided by the stakeholders and they were included in the common consent form and the final report. The workgroup continues to meet and discuss the report and the consent form.

North Dakota State Action Plan Assuming the North Dakota HITAC endorses the final UM HIE Tools, the HITAC will undertake the following State Action Plan for implementation of the UM HIE Tools:

1. Legislative and Regulatory Policy Levers North Dakota will continue to evaluate legislative and regulatory policy levers to see if they need to be changed, added or delete. Additionally, the 2011 legislature required that administrative code need to be developed for the health information exchange. As these policies are developed, any required rules will be included in the administrative regulations.

2. Market Levers North Dakota will continue to evaluate the need for market lever approaches, through its purchasing power, to incorporate the UM HIE tools both short and long‐term. If it is determined that market levers are need to incorporate the UM HIE Tools, they will be developed and implemented through future requests for proposals released by the State.

3. Informal Policy Levers HITAC will use informal policy levers by building on current partnerships and seeking to build new relationships to engage with providers on the effectiveness of using the UM HIE Tools as they seek to improve workflow processes when conducting interstate exchange. Additionally, after formal review and approval of the UM HIE Tools by the HITAC, partnerships will be built with the regional extension center as a way to facilitate the use of the tools by practitioners.

A. Collaborations and Communications HITAC will collaborate with the HITAC workgroups, North Dakota’s HIT Regional Extension Center, and the various provider and consumer associations in North Dakota on efforts to broadly educate providers, patients and consumers on the benefits of electronic Health Records (EHRs) and how the practice of interstate exchange could help them. HITAC identified the following activities for 2011–2012 to advance interstate exchange:

1. Communication and outreach to providers and associations (presentations, emails, workgroups, newsletters etc.).

2

2. Identify providers in North Dakota willing to participate in a Pilot Project to launch the use of the UM HI Common Consent Form and evaluate the tools’ effectiveness for improving interstate exchange.

3. Use the 2012 North Dakota e‐Health Summit and other forums to share preliminary learning’s from the Pilot Project with providers and consumers.

4. Update the North Dakota HITAC website to make available the UM HIE tools.

B. Moving Forward The HITAC will continue to seek stakeholder communications and input through the Legal and Policy Workgroup to inform the HITAC’s approach to making the UM HIE Common Consent Form and other UM HIE Tools available to providers and to educate on their use. HITAC will continue to evaluate and develop legislative or regulatory policy levers, market leavers, and informal policy levers to ensure providers’ acceptance and use of the UM HIE Tools as required.

Appendix C-3:

South Dakota State Action Plan

1

South Dakota State Action Plan Upper Midwest HIE State Health Policy Consortium

Background In 2010 the Office of the National Coordinator for Health IT (ONC) created the State Health Policy Consortium (SHPC) project to support multistate initiatives that would develop solutions to policy challenges specific to interstate health information exchange. The Upper Midwest Health Information Exchange (UM HIE) project was the first multistate consortium to apply and receive approval from RTI International, the research institute that manages the overall SHPC project for ONC. Participating states include Minnesota (serving as lead state), Illinois, North Dakota, South Dakota, and Wisconsin. The UM HIE project team worked to develop tools designed to be concrete solutions to challenges affecting the exchange of health information for treatment purposes among the UM HIE states. The South Dakota Department of Health (DOH) representatives on the UM HIE project actively sought South Dakota stakeholder input by engaging the SD eHealth Collaborative.

South Dakota Plans for Implementation Each of the UM HIE states was charged with developing a plan for encouraging the use of the UM HIE Tools in the state (State Action Plan). The UM HIE project team articulated possible Implementation Levers that each state could consider adopting as part of its State Action Plan. The types of Implementation Levers proposed include (1) market levers (i.e., vendor contract terms mandating the use of the UM Tools; and (2) informal levers (i.e., provider education and outreach).

State Action Plan Prerequisite: South Dakota Endorsement of Stakeholder Recommendations. The South Dakota UM HIE project participants actively engaged and consulted with the SD e‐Health Collaborative, the Secretary of Health, and other stakeholders at each stage of the work. Assuming that the Common Consent Form would be completed by the UM HIE group our stakeholders thought it would be valuable resource to advance the electronic exchange of patient health information with providers across state borders and enhance patient treatment and care, while ensuring that patients continue to have the right to control access over their patient health records.

South Dakota State Action Plan The South Dakota DOH may undertake the following State Action Plan for implementation of the UM HIE Tools:

1. Legislative and Regulatory Policy Levers In the short term at least, implementation strategies that rely on formal legislative or rulemaking action are not likely to be adopted. South Dakota will therefore employ alternative levers to encourage the use of the UM HIE Tools that rely on less formal implementation mechanisms.

A. Endorsement by the South Dakota Department of Health DOH will consult with the Secretary of Health to develop a letter or declaration of endorsement to be issued by the Secretary that encourages providers and other entities holding or facilitating the exchange of patient health information in South Dakota to accept and use the UM HIE Common Consent Form as a valid form of patient consent for the release of the patient’s health information to another provider.

2

B. Endorsement by South Dakota Statewide Health Information Exchange The SD HIE will facilitate the use of the UM HIE common consent form across state borders via a pilot project with Minnesota. Additionally, the SD HIE may make the common consent form available electronically via the exchange infrastructure.

C. Consideration of Future Legislative or Regulatory Action At the current time, the political and economic climate in South Dakota would not support legislative or rulemaking initiatives for formal action to require the acceptance and use of the UM HIE Tools.

2. Market Levers South Dakota will adopt a range of market lever approaches to incorporate the UM HIE tools both short and long‐term.

A. South Dakota Health Information Exchange Procurement Activities Through current procurement activities for the development of South Dakota’s technical infrastructure, South Dakota may require:

1. SD could draft contract language requiring a vendor to implement a common consent form if one is available.

2. Any future RFP may include a requirement to use the UMHIE tools and resources such as the common consent form.

3. The use of common consent form as a condition of payment as part of the contract.

4. Informal Policy Levers DOH will use informal policy levers by building on current partnerships and seeking to build new relationships to engage with providers on the effectiveness of using the UM HIE Tools as they seek to improve workflow processes when conducting interstate exchange.

A. Collaborations and Communications DOH will collaborate with the South Dakota eHealth Collaborative, South Dakota’s HIT Regional Extension Center, Medicaid, and the various provider and consumer associations in South Dakota on efforts to broadly educate providers, patients and consumers on the benefits of electronic Health Records (EHRs) and how the practice of interstate exchange could help them. DOH identified the following activities for 2011‐2012 to advance interstate exchange:

1. Use annual 2011 SD eHealth Summit to share UM HIE tools and include dialogue with provider association representatives on how they would promote it with their own audiences.

2. As part of South Dakota’s Health Information Exchange Cooperative Agreement, DOH will seek to develop educational materials and resources on health information exchange, including the use of UM HIE tools, for providers and consumers. The Cooperative Agreement provides the opportunity to contract with a marketing firm to develop strategies and a broad range of materials with appropriate focused feedback on how to effectively use them.

3. Identify providers in South Dakota willing to participate in a Pilot Project to launch the use of the UM HIE Common Consent Form and evaluate the tools’ effectiveness for improving interstate exchange.

3

4. Use the 2012 South Dakota eHealth Summit and other forums to share preliminary learning’s from the Pilot Project with providers and consumers.

5. DOH may work with other stakeholders to identify specialty areas that could benefit from UM HIE tools; and develop plans for engaging those groups for learning about and using the tools.

6. Continue to update the South Dakota eHealth website to make available the UM HIE tools and incorporate South Dakota stakeholders’ suggestions and other related information to aid in the promotion of their use.

Moving Forward The South Dakota Department of Health will continue to seek stakeholder input through the SD eHealth Collaborative, Secretary of Health, Regional Extension Center, Medicaid, and other statewide stakeholders. DOH may seek endorsement from the Secretary of Health the SD HIE on developing market leavers and informal policy levers to engage providers’ in the use of the UM HIE Tools.

Appendix C-4:

Wisconsin State Action Plan

1

Wisconsin State Action Plan Upper Midwest HIE State Health Policy Consortium

Background In 2010 the Office of the National Coordinator for Health IT (ONC) created the State Health Policy Consortium (SHPC) project to support multistate initiatives that would develop solutions to policy challenges specific to interstate health information exchange. The Upper Midwest Health Information Exchange (UM HIE) project was the first multistate consortium to apply and receive approval from RTI International, the research institute that manages the overall SHPC project for ONC. Participating states include Minnesota (serving as lead state), Illinois, North Dakota, South Dakota, and Wisconsin. The UM HIE project team worked to develop tools designed to be concrete solutions to challenges affecting the exchange of health information for treatment purposes among the UM HIE states.

Wisconsin Plans for Implementation As part of Wisconsin’s work plan, feedback was obtained from stakeholders on the UM HIE Common Consent form and tools. Wisconsin engaged the Wisconsin Statewide Health Information Network (WISHIN) which is the State Designated Entity (SDE) for state‐level HIE governance. A workgroup of the WISHIN Policy Committee, the Interstate Exchange Workgroup was also involved. This workgroup consists of representatives who exchange information with states on the Wisconsin border, including Illinois and Minnesota. The UM HIE Common Consent form was circulated among the group and they held a series of conference calls to discuss the form. In addition, the WISHIN Interstate Exchange Workgroup shared the proposed common consent form and tools with members of the Wisconsin Health Information Management Association (WHIMA) and the HIPAA Collaborative of Wisconsin (HIPAA‐COW) who shared the form and tools with providers along the Wisconsin bordering states for feedback.

The WISHIN Interstate Workgroup provided feedback on the UM HIE Common Consent form to the Consortium. In addition, the workgroup made a recommendation to the WISHIN Policy Committee to make the UM HIE Common Consent and tools available to providers who could choose to use it at their own discretion. WISHIN can provide a link to the Consortium's report and work products.

State Action Plan Prerequisite: Wisconsin Stakeholder Endorsement. Wisconsin believes the UM HIE Common Consent form and tools need to be piloted/tested before endorsing them. Wisconsin would be interested in participating in a Pilot Project (funded by ONC through RTI) and would help identify providers to participate in a project to pilot the use of the UM HIE Common Consent form and associated tools through electronic exchange (i.e., Direct secure messaging). A pilot would allow participants to evaluate whether this is an effective form and approach for reducing barriers in interstate exchange, determine impact on workflows, and provide feedback and recommendations for improving the form and tools.

Wisconsin State Action Plan The Wisconsin Department of Health Services (DHS) may undertake the following State Action Plan for implementation of the UM HIE Tools:

2

1. Legislative and Regulatory Policy Levers In the short term at least, implementation strategies that rely on formal legislative or rulemaking action are not likely to be adopted. There is the potential for future legislative activity that would enable health care providers to exchange health information between providers for treatment purposes that they are currently not able to share without written consent. The state hospital association and state medical society are working on a legislative proposal that would remove current legal barriers to this exchange.

2. Market Levers Wisconsin expects to use market levers to support the use of the form if and when a successful pilot project demonstrates the form and its procedures are effective in reducing barriers to interstate exchange in the region.

3. Informal Policy Levers DHS will use informal policy levers by building on current partnerships and developing new relationships to engage with providers on the effectiveness of using the UM HIE Tools and the most effective workflow processes for conducting interstate exchange.

A. Collaborations and Communication Until a Pilot Project is completed and the results of the pilot communicated, it will be difficult to obtain WISHIN’s buy‐in and endorsement of the UW HIE Common Consent Form. A successful pilot will make it easier to encourage providers and other entities facilitating the exchange of information in Wisconsin to accept and use the UM HIE Common Consent form as a valid and useful form of patient consent for the release of the patient’s health information to another provider when required.

B. Pilot Projects Wisconsin plans to participate in Pilot Projects with Minnesota to evaluate the effectiveness of the UM HIE Common Consent Form using Direct secure messaging to electronically send the Consent Form and request the exchange of health information across state borders. The WISHIN Policy Committee’s Interstate Exchange Workgroup will help identify providers in Wisconsin willing to participate in a Pilot Project.

Moving Forward

If the results of the Pilot Projects are positive, DHS will continue to work with WISHIN to reconsider endorsing and promoting the use of the UM HIE Tools by providers. Also depending on the results of the Pilot Projects, DHS will consider whether it can use and endorse the form (as it has done with an Advance Directive form for Wisconsin) and make it available to the public on the Department’s Web site or whether the Medicaid program could use the form as an agency‐endorsed form with their contracted providers.

Appendix D:

Pilot Proposal to Demonstrate UM HIE Consortium Work

1

Pilot Projects ONC State Health Policy Consortium Projects – Upper Midwest (UM) HIE Consortium Proposal

Pilot Projects

Participating UM HIE states discussed the value of developing pilot projects to test the use of the UM HIE Tools in a provider or clinic setting. Proposed pilots will build upon trust agreements established or being implemented with HISPs within participating states to facilitate the exchange of health information using the Direct secure messaging transport protocol (Direct) with participating providers across state borders.

Each pilot project would begin between two UM HIE participating states and requires:

1. Identifying an appropriate partner state. 2. Identifying and selecting providers that are presently using or are willing to use Direct and are willing to

test the use of the UM HIE Tools with a provider in the participating border state. a. Each participating state will review lists of potential provider participants within its state, such as

small providers and hospitals in bordering counties or systems that regularly exchange across borders;

b. Contact them to determine whether they already have a Direct address and if not whether they are willing to get an address through one of the available commercial HISPs; and

c. Invite them to participate in a pilot. 3. Identifying authorized HISPs or Health Data Intermediaries used by the selected providers and engaging

with them to establish the appropriate trust agreements to enable them to exchange information across state borders.

a. Participating states will contact authorized HISPs/HDIs within its state; b. Encourage participation in a pilot; and c. Help facilitate dialogue with the cross‐border partnering HISP/HDI to enter into a trust

agreement, if necessary. 4. Sharing the UM HIE Consent Form with selected providers and encouraging its use.

a. Participating states may need to provide training on use of the UM HIE Consent Form to participating providers.

5. Requesting resources from ONC to support this project. a. Overall project manager will be required to ensure proper execution of each pilot project. b. Specialized resources will be required to establish consistent quantitative and qualitative

mechanisms (i.e. interviews, surveys, questionnaires) in order to measure use of the form, effectiveness of implementation, and a provider’s likelihood of continued use.

c. Additional resources will also be required to coordinate and prepare a summary report of project(s) findings and develop tools that can be shared and used to advance interstate exchange among non UM HIE states including:

i. Capturing results of and feedback from stakeholders on the UM HIE pilots and conducting a comparative analysis of the pilots

ii. Describing advantages/disadvantages of using the UM HIE Consent Form and making recommendations for improving the usability of the form

iii. Recommendations on practice management or clinical workflow integration iv. Other best practice recommendations

2

Scope

• A pilot will begin between two UM HIE states and there may be multiple pilots • Focus on the use and exchange of the UM HIE Consent Form using Direct • Evaluation of the effectiveness of using the UM HIE Consent Form • Preparing a recommendation for workflow integration based on pilot findings • Sharing other lessons learned so that information can be used to improve the Consent Form and expand its

use

Timel ine

It is proposed that the pilot projects be completed in a period of nine months once ONC approves this proposal for piloting the use of the UM HIE Consent form via electronic exchange (i.e., Direct) and provides State Health Policy Consortium resources/funding. An example timeline is outlined below:

Month 1: Each participating UM HIE state to identify and select providers.

Month 2: Establish appropriate agreements between the HISPs and/or the State Designated Entities

Month 2 – 7: Begin pilots; actively exchange UM HIE Consent Form

Month 7 – 9: Evaluation Period

Month 9: Complete report and make recommendations for improvement/future expansion

upper midwest hie consortium - north dakota€¦ · the upper midwest health information exchange...

Documents